Documented incident response plan for data breaches

GDPR Art. 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach — a hard deadline that cannot be met without a pre-existing response plan. Art. 34 requires notification to affected individuals when the breach is likely to result in high risk. NIST CSF 2.0 RS.RP-01 and ISO-27001:2022 A.5.26 both mandate documented incident response procedures. In practice, the 72-hour GDPR window passes faster than teams without a plan expect: stakeholder identification, breach scoping, legal review, and regulatory filing all compete for the same hours. Discovering the playbook gap in the middle of an incident guarantees regulatory notification failure.

Create INCIDENT_RESPONSE.md at the project root with at minimum the detection method, internal escalation chain, the 72-hour regulatory notification target, and the user notification template.

# INCIDENT_RESPONSE.md

## Detection
- Automated: Sentry error alerts, unusual DB query spikes, auth failure bursts
- Manual: User reports, security researcher disclosure, third-party notification

## Triage (within 1 hour)
- Incident owner: [Engineering Lead]
- Assess: what data, how many users, how accessed
- Contain: rotate compromised credentials, revoke tokens, isolate affected services

## Regulatory Notification (GDPR: within 72 hours)
- Authority: national supervisory authority (e.g., ico.org.uk for UK)
- Report: breach nature, data categories, estimated user count, consequences, measures taken

## User Notification (within 72 hours when high risk)
- Channel: email from support@example.com
- Content: what happened, what data, what we have done, what users should do

## Post-Incident
- Root cause analysis within 5 business days
- Update controls; document in incident log