Privacy Incident Response Tabletop Kit — What's Inside

Privacy Incident Response Tabletop Kit

Four 90-minute facilitated breach scenarios — your annual tabletop exercises, already written and ready to run.

This is a preview of the document. It's an editable Word file, so there's nothing to run — here's exactly what you get, section by section, plus a real excerpt. Every fill-in is a marked placeholder.

At a glance

4full scenarios

90 minper session

1–5scoring rubric

Wordfully editable

What's inside

Every section that ships in the file.

Facilitator guideHow to run a 90-minute session: room setup, timing, roles, and ground rules.
Scenario 1 — Misdirected mail-mergeA bulk email exposes recipients to each other and goes public. Injects on containment, notification clocks, and press.
Scenario 2 — Ransomware + exfiltration claimEncryption plus a data-theft threat. Injects force the regulatory-clock and ransom-decision debates.
Scenario 3 — Over-permissioned AI assistantAn AI tool surfaces a restricted HR folder. Injects probe access governance and ADMT exposure.
Scenario 4 — Vendor breach in the newsYou learn of a processor breach from a headline, not the vendor. Injects test contract clocks and third-party duties.
Timed injects & curveballsEach scenario ships with escalating injects and a curveball to drop when the room gets comfortable.
Hot-wash templateStructured debrief to capture what worked, what didn't, and who owns each gap.
1–5 scoring rubricRate the team's response and know when a scenario needs re-running.

Excerpt — Scenario 2, Inject 3

A real excerpt from the document — teal = your fill-in

Inject 3 — T+40 minutes

The attacker posts a sample of [N] employee records to a leak site and sets a [HOURS]-hour deadline. Legal asks whether this changes your notification obligations. Facilitator prompt: Does confirmed exfiltration move this from a security event to a reportable breach under [APPLICABLE LAW]? Who signs off, and what is the clock now?