# Breach Response Playbook

A suspected or confirmed personal data breach. PDPA §37 + GDPR Art. 33–34.

## Timeline

- **0h** — declare incident (severity SEV1).
- **+1h** — contain (stop the bleed).
- **+24h** — initial impact assessment.
- **+72h** — notify regulator(s) if confirmed personal data breach with risk to subjects.
- **+72h** — notify affected subjects if high risk (PDPA §37(2) / GDPR Art. 34).
- **+14 days** — full post-incident report to the regulator if requested.

## Step 1 — Containment

1. Identify the affected system + scope.
2. Stop the leak: rotate compromised credentials, disable affected accounts, isolate the host.
3. Snapshot the system state for forensics BEFORE patching (where safe).
4. Engage the incident-orchestrator (`.claude/orchestrators/incident-orchestrator.md`).

## Step 2 — Assessment (within 24h)

Answer in writing:

- **What** data was affected (tier + categories per `data-classification.md`)?
- **Whose** data — how many subjects, which tenants, which countries?
- **How** did it happen (root cause)?
- **What's the risk** to subjects (financial, identity, embarrassment)?
- **Is it ongoing**?

If Confidential or Restricted data is affected with non-trivial likelihood of harm → notify.

## Step 3 — Regulator notification (within 72h)

If the breach is reportable:

- **Thailand**: PDPC via the [notification portal](https://www.pdpc.or.th/).
- **EU**: relevant Supervisory Authority (the lead DPA for the establishment).

Include:

- Nature of breach
- Categories + approximate number of subjects + records
- DPO contact
- Likely consequences
- Measures taken / proposed

Late notification requires explanation.

## Step 4 — Subject notification (high risk)

Notify subjects directly when likely to result in a high risk. Use email; if email isn't feasible, public communication.

Include:

- Plain-language description
- DPO contact
- Likely consequences
- Measures they should take (rotate passwords, watch statements)

Don't notify when:

- Encryption rendered the data unintelligible AND
- Subsequent measures ensure no risk materializes OR
- Disproportionate effort (use public communication instead)

## Step 5 — Remediation + Postmortem

- Apply the systemic fix (not just the trigger).
- Write a blameless postmortem per `.claude/skills/incident-postmortem/SKILL.md`.
- If architecture changed, write an ADR.
- Update this playbook with lessons learned.

## Contacts (replace with real)

- **Incident commander**: on-call rotation in PagerDuty.
- **DPO**: `dpo@loma-portal.example`.
- **Legal**: `legal@loma-group.example`.
- **PR/Comms**: `comms@loma-group.example`.
- **PDPC (Thailand)**: published portal.
- **Lead EU DPA**: per processing register.

## Practice

Run a tabletop exercise every 6 months. Cover at least:

- Insider misuse of `documents.read`.
- Stolen access token.
- Backup blob in a misconfigured bucket.
- Phishing → compromised admin.
