# Using the iCompaas Breach Notification workflow

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_ss_62000112443_fc2f186a17-using-the-icompaas-breach-notification-workflow
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Data Breach Notification](https://support.icompaas.com/support/solutions/62000112443) › [Topics](https://support.icompaas.com/support/solutions/folders/f_gen_62000112443_topics)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Privacy · Incident Management

### When to open a breach record

Open one as soon as you have _reasonable certainty_ that a confidentiality, integrity or availability event involving personal data has occurred. Don't wait for investigation to complete — the 72-hour (GDPR / DPDP) and 60-day (HIPAA) clocks run from awareness, not from confirmation.

### Step-by-step

1.  **Privacy → Incidents → New**. Select the regulator scope (GDPR, HIPAA, DPDP, CCPA…). iCompaas pre-loads the applicable timelines.
2.  **Classify** the breach: confidentiality, integrity, availability (or a combination). Estimate data subject count and categories of personal data.
3.  **Containment evidence** — paste tickets, change records or chat threads. Everything is timestamp-locked.
4.  **Run the risk assessment** — built-in 4-factor for HIPAA, "likely to result in high risk" assessment for GDPR. The outputs determine whether individual notification is required.
5.  **Draft notifications** — the workflow pre-fills the Supervisory Authority report and the individual-notice email per regulator from the case data.
6.  **Reviewer sign-off** — required Legal/Privacy approver before any external send. Approvals are recorded with timestamp and the version reviewed.

### Reporting

At quarter-end the Privacy module produces a breach register summarising opened, contained, notified, and closed incidents — the format auditors expect under SOC 2 Privacy, ISO 27701 and GDPR Article 30.

## Related compliance guidance

- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): Breach notification under Articles 33 and 34: the 72-hour clock, what to record and when to notify individuals.
- [HIPAA compliance for SaaS: a practical implementation guide](https://support.icompaas.com/compliance/hipaa): The HIPAA Breach Notification Rule timelines and thresholds for covered entities and business associates.
- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): Breach reporting duties to the Data Protection Board and affected Data Principals under the DPDP Rules.