dpdp.storeevidence workbenchRESOURCE LIBRARY

Home / Tools / Breach Detail Pack Planner

08 / In your browser / VERSION 0.3.0

Breach Detail Pack Planner

Keep incident facts, communications and detailed follow-up tasks in one local worksheet.

Launch locallyRead the working guide
LOCAL INSTRUMENT / SYNTHETIC EXAMPLE INCLUDED

Method

Builds three source-labelled evidence lanes for affected-person communication, the initial Board description and the 72-hour detailed Board record without transmitting incident data.

Use it safely

Begin with the synthetic example in the toolbench, then minimise any real-world input. Inspect each finding, its source/status note and the facts behind it before exporting a result.

What it cannot determine

It cannot determine notification obligations, replace incident counsel or send a notification.

Processing boundary. This preview processes current input in browser memory. No input is submitted or stored by dpdp.store. Results are evidence-building aids, not legal approval, certification or an official schema.

8 minute working guide / SYNTHETIC WALKTHROUGH

From input to a reviewable handoff.

GUIDE 0.5
Reviewed
2026-08-26
Legal status
editorial analysis
Changelog
0.5.0 — first public static working guide.

What this produces: A local completeness register and three source-labelled evidence lanes separating recorded facts, open questions, mitigation, communications, timing and evidence tasks.

FICTIONAL PRACTICE SCENARIO

A fictional team is planning an incident worksheet after unusual access is detected. It knows its timezone-aware awareness timestamp and affected test system but not yet the full extent or likely impact.

Before you begin

  • Use synthetic or category-level facts while learning; real incident data belongs in an approved incident-response system.
  • Identify the incident lead, evidence owner and legal or regulatory review route before generating a plan.
  • Recheck current source status and all other applicable incident duties; this preview does not calculate an obligation.

Walk the evidence sequence

  1. Anchor awareness and separate facts from hypotheses

    Record a local incident reference, awareness timestamp with timezone, occurrence status, nature, extent, location, affected categories and people groups only to the level confirmed. Keep unknown or pending entries explicit instead of filling gaps with assumptions.

    Evidence to inspect
    The completeness register distinguishes recorded facts from open fields and preserves the awareness anchor without calculating a deadline.
    Human review
    Protect forensic evidence and avoid copying unnecessary personal data into parallel documents.

  2. Plan mitigation and consequence review

    Assign containment, preservation, restoration and likely-consequence questions to accountable owners outside the tool.

    Evidence to inspect
    The local plan can align technical, operational and communication work without transmitting the incident.
    Human review
    Do not infer impact from record count alone; assess context, sensitivity, access, safeguards and credible misuse with qualified responders.

  3. Inspect all three evidence lanes

    Use the source/status-labelled structure to organise affected-person facts, the initial Board description and the more detailed Board record that requires follow-up.

    Evidence to inspect
    Each lane shows its Rule 7 pinpoint, source timing, linked-field count and boundary while stating that the provisions are notified for future commencement.
    Human review
    Current legal, contractual, sectoral or other-law duties may differ and require immediate separate review.

  4. Review communication before any send

    Prepare factual, audience-appropriate communication in the approved incident process and reconcile it with the evidence pack.

    Evidence to inspect
    The tool creates no submission, email, message or Board notification; export is local and deliberate.
    Human review
    Authorised incident, security, communications and legal reviewers must approve recipients, content and timing.

Handoff check

  • Are confirmed facts clearly separated from assumptions and open questions?
  • Is the awareness timestamp timezone-aware, and are evidence preservation and decision owners traceable?
  • Were current legal, contractual and sectoral duties reviewed outside the planner?
STOP / REVIEW BOUNDARY

The planner does not investigate an incident, determine whether notification is required, calculate a deadline, contact anyone or replace incident counsel.

Security and parsing

  • Inputs have byte, row or component limits appropriate to the parser.
  • Imported content is treated as text or data and is never executed.
  • Spreadsheet exports neutralise formula-leading cells.
  • Use the per-tool reset or “Clear current toolbench state” to remove current in-tab input and results. Downloaded files remain under your control.

Version record

0.3.0 · 26 August 2026: deterministic public static implementation, synthetic fixture and bounded local parser. Guide record 0.5 · 26 August 2026.