Following a privacy breach report, what is the recommended next step?

• A. Document details and initiate incident response per policy
• B. Forget about it
• C. Only inform the person affected
• D. Publicly disclose the breach immediately

Answer: (A)

When a privacy breach is reported, the immediate priority is to document what happened and start the incident response process per policy. This creates a clear, auditable record and triggers the predefined steps to contain the breach, assess its impact, preserve evidence, and involve the right teams—privacy, security, IT, and legal. Following the policy also guides whether and how to notify regulators or affected individuals, ensuring actions align with legal and regulatory requirements.

Skipping documentation or the response process leaves gaps that can worsen exposure and violate policy. Notifying only the affected person misses broader risk management needs and any mandatory internal or regulatory notifications. Public disclosure without proper containment and authorization can cause additional harm and violate established procedures.