Personal-data incidents: readiness, evidence, and deletion

Record detection time, signal source, affected system, data categories, and estimated volume. Do not redistribute the data through work chats.

Prepare one intake record with incident ID, reporter, UTC time, affected tenant, systems, suspected vector, and confidence level. An automated alert is not a confirmed breach; the responder preserves original signals and classifies the event. Restrict case access to the response team and replace actual data samples with hashes or safe indicators where possible.

Revoke compromised keys, close unintended access, and preserve tamper-resistant logs. Link changes to the incident identifier.

Use predefined containment actions by secret and system type: revoke a token, close a public object, restrict a role, or isolate a node. Record time, actor, and expected effect for every change. Preserve required logs in protected immutable storage before cleanup. If an external command has an unknown outcome, reconcile state first and never repeat a destructive action automatically.

For an established incident that violates data-subject rights, Russian law provides for an initial Roskomnadzor notice within 24 hours and a follow-up within 72 hours containing the internal investigation results and information about responsible persons when identified. Record detection time, notice content, delivery evidence, and assess any other applicable notifications separately.

Maintain a control timeline covering detection, factual confirmation, initial assessment, decisions, and communications sent. When data-subject rights are violated, the Roskomnadzor process has two control stages: an initial notice within 24 hours and internal-investigation results within 72 hours. A responsible specialist should verify recipients and content against current requirements; this article is not a substitute for that review. Communicate confirmed facts, label unknowns, and retain delivery evidence without unnecessary data exposure.

After remediation, update the threat model, retention schedule, and training. Keep incident evidence separately and only as long as necessary.

Closure requires a post-incident review covering root cause, containment effectiveness, affected records, corrective actions, owner, and verification date. Retain evidence under a separate approved period and legal hold where applicable; ordinary user data should not be kept indefinitely under an investigation label. At expiry, perform verifiable deletion from the case system and its backups.