Incident management
Organisation: [complete] · Owner: [complete] · Approved by: [complete]
Effective from: [complete after approval] · Review: [complete]
Contacts and accountability
Define an available reporting contact, incident lead, technical response, communications, legal support and deputies. State who may stop a service or isolate an account. Test the contact, including out-of-hours coverage where the service requires it.
Procedure
- Intake: record awareness time, reporter and available facts.
- Assessment: identify affected systems, individuals, data, extent and severity. Keep confirmed facts separate from estimates.
- Containment: take authorised action and preserve evidence; consider the impact of suspending service.
- Notification: assess each legal and contractual regime separately. Do not wait for complete analysis while a notification deadline is running.
- Recovery: verify removal of the cause, data integrity and return-to-service criteria.
- Learning: assign corrective actions, owners and effectiveness checks.
Distinguishing notifications
| Regime | What triggers assessment | Detailed rules |
|---|---|---|
| GDPR | A personal data breach, controller/processor role and risk to individuals | GDPR — the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless a risk to individuals’ rights and freedoms is unlikely (Article 33(1)); separate processor and individual notification rules |
| Czech cybersecurity law | A regulated service, regime and relevant incident type | NIS2 — initial reporting under section 16 of the Czech Cybersecurity Act; follow-up notification and reports subject to section 16(3), intermediate reports on request; account for the special digital-services regime in section 18 |
| DORA | A major ICT incident at an in-scope financial entity | DORA — classification and awareness triggers, subsequent reports |
| AI Act | A serious incident of a relevant high-risk system, role and applicability date | AI Act — particularly Article 73 and deployer obligations |
An internal response target is not a statutory notification deadline. Record the triggering time, recipient, deadline, content and subsequent updates for each notification. Not every hallucination is automatically a serious incident under the AI Act.
Records and review
Record the timeline, impact, actions, decisions to notify or not notify, reports and responsible people. Plan evidence retention around purpose, disputes and applicable rules; there is no shared five-year period for all incidents.
Exercise the procedure using a concrete scenario and update it from the results. Unconfirmed contacts and generic placeholders must not remain in the operational version.
Template reviewed on 6 September 2026. Detailed legal sources are in the linked guides. L1 — Align helps prepare evidence and responsibilities; adaptation and implementation scope is agreed in the proposal.