Data breach response BPMN example

Data breach response is the process an organisation follows between suspecting a breach and closing it with regulators, customers, and its own systems satisfied. Teams map it because UK GDPR gives them 72 hours to notify the ICO of a reportable breach, and a deadline that short leaves no room to improvise the sequence of containment, assessment, and notification. The classic failures are notifying before the scope is understood, or debating reportability past the deadline.

The model is a single pool with four lanes: Security operations, Data protection officer, Legal, and Communications. Two exclusive gateways carry the regulatory logic: whether the breach is reportable to the ICO, and whether it poses a high risk to individuals. Worth noticing is that the non-reportable branch flows through "Document decision rationale" rather than skipping ahead: a decision not to report must be evidenced just as carefully as a report.

Data breach response: BPMN 2.0 diagram

Data breach response process modelled as a BPMN 2.0 diagram

Download .bpmn Download SVG or open it in the free BPMN viewer

Standard BPMN 2.0 interchange XML: opens in Camunda Modeler, Signavio, Bizagi, and any other compliant tool.

The process at a glance

Starts when

Breach suspected

Ends with

Breach closed

Lanes

Security operations · Data protection officer · Legal · Communications

Decisions

Reportable to the ICO? · High risk to individuals?

How to read this diagram

Containment comes first: from the "Breach suspected" start event, Security operations contains the affected systems before anything else happens. The Data protection officer then assesses the scope and data types involved, feeding the gateway "Reportable to the ICO?". Its Yes branch notifies the ICO within 72 hours, while the default No branch documents the decision rationale; both branches converge on Legal, which advises on notification duties to partners and processors.

Next, the gateway "High risk to individuals?" decides whether Communications must inform affected individuals on the Yes branch, or whether the default No branch proceeds directly. Either way the flow reaches Security operations again to remediate the root cause, then the Data protection officer holds a lessons learnt review, and the process ends at "Breach closed". The single end event is deliberate: however the notification decisions fell, a breach is only ever closed one way, with remediation and review complete.

BPMN elements used

Element	Count	In this diagram
Start event	1	Breach suspected
End event	1	Breach closed
Task	3	Contain affected systems, Document decision rationale, Remediate root cause
User task	3	Assess scope and data types, Advise on notification duties, Hold lessons learnt review
Send task	2	Notify ICO within 72 hours, Inform affected individuals
Exclusive gateway	2	Reportable to the ICO?, High risk to individuals?

View the BPMN 2.0 XML for this diagram

<?xml version="1.0" encoding="UTF-8"?>
<bpmn2:definitions xmlns:bpmn2="http://www.omg.org/spec/BPMN/20100524/MODEL" xmlns:bpmndi="http://www.omg.org/spec/BPMN/20100524/DI" xmlns:dc="http://www.omg.org/spec/DD/20100524/DC" xmlns:di="http://www.omg.org/spec/DD/20100524/DI" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="Definitions_1" targetNamespace="http://bpmn.io/schema/bpmn" exporter="swimdraft" exporterVersion="1.0">
  <bpmn2:collaboration id="Collaboration_1">
    <bpmn2:participant id="pool_db" name="Data breach response" processRef="Process_pool_db" />
  </bpmn2:collaboration>
  <bpmn2:process id="Process_pool_db" isExecutable="false">
    <bpmn2:laneSet id="LaneSet_pool_db">
      <bpmn2:lane id="lane_db_sec" name="Security operations">
        <bpmn2:flowNodeRef>start_db</bpmn2:flowNodeRef>
        <bpmn2:flowNodeRef>t_db_contain</bpmn2:flowNodeRef>
        <bpmn2:flowNodeRef>t_db_remed</bpmn2:flowNodeRef>
      </bpmn2:lane>
      <bpmn2:lane id="lane_db_dpo" name="Data protection officer">
        <bpmn2:flowNodeRef>t_db_assess</bpmn2:flowNodeRef>
        <bpmn2:flowNodeRef>g_db_report</bpmn2:flowNodeRef>
        <bpmn2:flowNodeRef>t_db_ico</bpmn2:flowNodeRef>
        <bpmn2:flowNodeRef>t_db_doc</bpmn2:flowNodeRef>
        <bpmn2:flowNodeRef>g_db_risk</bpmn2:flowNodeRef>
        <bpmn2:flowNodeRef>t_db_review</bpmn2:flowNodeRef>
        <bpmn2:flowNodeRef>end_db</bpmn2:flowNodeRef>
      </bpmn2:lane>
      <bpmn2:lane id="lane_db_legal" name="Legal">
        <bpmn2:flowNodeRef>t_db_legal</bpmn2:flowNodeRef>
      </bpmn2:lane>
      <bpmn2:lane id="lane_db_comms" name="Communications">
        <bpmn2:flowNodeRef>t_db_inform</bpmn2:flowNodeRef>
      </bpmn2:lane>
    </bpmn2:laneSet>
    <bpmn2:startEvent id="start_db" name="Breach suspected">
      <bpmn2:outgoing>fdb1</bpmn2:outgoing>
    </bpmn2:startEvent>
    <bpmn2:task id="t_db_contain" name="Contain affected systems">
      <bpmn2:incoming>fdb1</bpmn2:incoming>
      <bpmn2:outgoing>fdb2</bpmn2:outgoing>
    </bpmn2:task>
    <bpmn2:userTask id="t_db_assess" name="Assess scope and data types">
      <bpmn2:incoming>fdb2</bpmn2:incoming>
      <bpmn2:outgoing>fdb3</bpmn2:outgoing>
    </bpmn2:userTask>
    <bpmn2:exclusiveGateway id="g_db_report" name="Reportable to the ICO?" default="fdb5">
      <bpmn2:incoming>fdb3</bpmn2:incoming>
      <bpmn2:outgoing>fdb4</bpmn2:outgoing>
      <bpmn2:outgoing>fdb5</bpmn2:outgoing>
    </bpmn2:exclusiveGateway>
    <bpmn2:sendTask id="t_db_ico" name="Notify ICO within 72 hours">
      <bpmn2:incoming>fdb4</bpmn2:incoming>
      <bpmn2:outgoing>fdb6</bpmn2:outgoing>
    </bpmn2:sendTask>
    <bpmn2:task id="t_db_doc" name="Document decision rationale">
      <bpmn2:incoming>fdb5</bpmn2:incoming>
      <bpmn2:outgoing>fdb7</bpmn2:outgoing>
    </bpmn2:task>
    <bpmn2:userTask id="t_db_legal" name="Advise on notification duties">
      <bpmn2:incoming>fdb6</bpmn2:incoming>
      <bpmn2:incoming>fdb7</bpmn2:incoming>
      <bpmn2:outgoing>fdb8</bpmn2:outgoing>
    </bpmn2:userTask>
    <bpmn2:exclusiveGateway id="g_db_risk" name="High risk to individuals?" default="fdb10">
      <bpmn2:incoming>fdb8</bpmn2:incoming>
      <bpmn2:outgoing>fdb9</bpmn2:outgoing>
      <bpmn2:outgoing>fdb10</bpmn2:outgoing>
    </bpmn2:exclusiveGateway>
    <bpmn2:sendTask id="t_db_inform" name="Inform affected individuals">
      <bpmn2:incoming>fdb9</bpmn2:incoming>
      <bpmn2:outgoing>fdb11</bpmn2:outgoing>
    </bpmn2:sendTask>
    <bpmn2:task id="t_db_remed" name="Remediate root cause">
      <bpmn2:incoming>fdb10</bpmn2:incoming>
      <bpmn2:incoming>fdb11</bpmn2:incoming>
      <bpmn2:outgoing>fdb12</bpmn2:outgoing>
    </bpmn2:task>
    <bpmn2:userTask id="t_db_review" name="Hold lessons learnt review">
      <bpmn2:incoming>fdb12</bpmn2:incoming>
      <bpmn2:outgoing>fdb13</bpmn2:outgoing>
    </bpmn2:userTask>
    <bpmn2:endEvent id="end_db" name="Breach closed">
      <bpmn2:incoming>fdb13</bpmn2:incoming>
    </bpmn2:endEvent>
    <bpmn2:sequenceFlow id="fdb1" sourceRef="start_db" targetRef="t_db_contain" />
    <bpmn2:sequenceFlow id="fdb2" sourceRef="t_db_contain" targetRef="t_db_assess" />
    <bpmn2:sequenceFlow id="fdb3" sourceRef="t_db_assess" targetRef="g_db_report" />
    <bpmn2:sequenceFlow id="fdb4" name="Yes" sourceRef="g_db_report" targetRef="t_db_ico">
      <bpmn2:conditionExpression xsi:type="bpmn2:tFormalExpression">Yes</bpmn2:conditionExpression>
    </bpmn2:sequenceFlow>
    <bpmn2:sequenceFlow id="fdb5" name="No" sourceRef="g_db_report" targetRef="t_db_doc" />
    <bpmn2:sequenceFlow id="fdb6" sourceRef="t_db_ico" targetRef="t_db_legal" />
    <bpmn2:sequenceFlow id="fdb7" sourceRef="t_db_doc" targetRef="t_db_legal" />
    <bpmn2:sequenceFlow id="fdb8" sourceRef="t_db_legal" targetRef="g_db_risk" />
    <bpmn2:sequenceFlow id="fdb9" name="Yes" sourceRef="g_db_risk" targetRef="t_db_inform">
      <bpmn2:conditionExpression xsi:type="bpmn2:tFormalExpression">Yes</bpmn2:conditionExpression>
    </bpmn2:sequenceFlow>
    <bpmn2:sequenceFlow id="fdb10" name="No" sourceRef="g_db_risk" targetRef="t_db_remed" />
    <bpmn2:sequenceFlow id="fdb11" sourceRef="t_db_inform" targetRef="t_db_remed" />
    <bpmn2:sequenceFlow id="fdb12" sourceRef="t_db_remed" targetRef="t_db_review" />
    <bpmn2:sequenceFlow id="fdb13" sourceRef="t_db_review" targetRef="end_db" />
  </bpmn2:process>
  <bpmndi:BPMNDiagram id="BPMNDiagram_1">
    <bpmndi:BPMNPlane id="BPMNPlane_1" bpmnElement="Collaboration_1">
      <bpmndi:BPMNShape id="pool_db_di" bpmnElement="pool_db" isHorizontal="true">
        <dc:Bounds x="20" y="20" width="1720" height="630" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="lane_db_sec_di" bpmnElement="lane_db_sec" isHorizontal="true">
        <dc:Bounds x="50" y="20" width="1690" height="130" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="lane_db_dpo_di" bpmnElement="lane_db_dpo" isHorizontal="true">
        <dc:Bounds x="50" y="150" width="1690" height="240" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="lane_db_legal_di" bpmnElement="lane_db_legal" isHorizontal="true">
        <dc:Bounds x="50" y="390" width="1690" height="130" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="lane_db_comms_di" bpmnElement="lane_db_comms" isHorizontal="true">
        <dc:Bounds x="50" y="520" width="1690" height="130" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="start_db_di" bpmnElement="start_db">
        <dc:Bounds x="112" y="59" width="36" height="36" />
        <bpmndi:BPMNLabel><dc:Bounds x="85" y="101" width="91" height="14" /></bpmndi:BPMNLabel>
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="t_db_contain_di" bpmnElement="t_db_contain">
        <dc:Bounds x="230" y="37" width="100" height="80" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="t_db_assess_di" bpmnElement="t_db_assess">
        <dc:Bounds x="380" y="167" width="100" height="80" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="g_db_report_di" bpmnElement="g_db_report">
        <dc:Bounds x="555" y="182" width="50" height="50" />
        <bpmndi:BPMNLabel><dc:Bounds x="522" y="162" width="116" height="14" /></bpmndi:BPMNLabel>
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="t_db_ico_di" bpmnElement="t_db_ico">
        <dc:Bounds x="680" y="167" width="100" height="80" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="t_db_doc_di" bpmnElement="t_db_doc">
        <dc:Bounds x="680" y="277" width="100" height="80" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="t_db_legal_di" bpmnElement="t_db_legal">
        <dc:Bounds x="830" y="407" width="100" height="80" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="g_db_risk_di" bpmnElement="g_db_risk">
        <dc:Bounds x="1005" y="182" width="50" height="50" />
        <bpmndi:BPMNLabel><dc:Bounds x="971" y="162" width="118" height="14" /></bpmndi:BPMNLabel>
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="t_db_inform_di" bpmnElement="t_db_inform">
        <dc:Bounds x="1130" y="537" width="100" height="80" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="t_db_remed_di" bpmnElement="t_db_remed">
        <dc:Bounds x="1280" y="37" width="100" height="80" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="t_db_review_di" bpmnElement="t_db_review">
        <dc:Bounds x="1430" y="167" width="100" height="80" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="end_db_di" bpmnElement="end_db">
        <dc:Bounds x="1612" y="189" width="36" height="36" />
        <bpmndi:BPMNLabel><dc:Bounds x="1594" y="231" width="72" height="14" /></bpmndi:BPMNLabel>
      </bpmndi:BPMNShape>
      <bpmndi:BPMNEdge id="fdb1_di" bpmnElement="fdb1">
        <di:waypoint x="148" y="77" />
        <di:waypoint x="230" y="77" />
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb2_di" bpmnElement="fdb2">
        <di:waypoint x="330" y="77" />
        <di:waypoint x="360" y="77" />
        <di:waypoint x="360" y="207" />
        <di:waypoint x="380" y="207" />
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb3_di" bpmnElement="fdb3">
        <di:waypoint x="480" y="207" />
        <di:waypoint x="555" y="207" />
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb4_di" bpmnElement="fdb4">
        <di:waypoint x="605" y="207" />
        <di:waypoint x="680" y="207" />
        <bpmndi:BPMNLabel><dc:Bounds x="611" y="187" width="21" height="14" /></bpmndi:BPMNLabel>
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb5_di" bpmnElement="fdb5">
        <di:waypoint x="605" y="207" />
        <di:waypoint x="660" y="207" />
        <di:waypoint x="660" y="317" />
        <di:waypoint x="680" y="317" />
        <bpmndi:BPMNLabel><dc:Bounds x="611" y="213" width="17" height="14" /></bpmndi:BPMNLabel>
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb6_di" bpmnElement="fdb6">
        <di:waypoint x="780" y="207" />
        <di:waypoint x="810" y="207" />
        <di:waypoint x="810" y="447" />
        <di:waypoint x="830" y="447" />
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb7_di" bpmnElement="fdb7">
        <di:waypoint x="780" y="317" />
        <di:waypoint x="810" y="317" />
        <di:waypoint x="810" y="447" />
        <di:waypoint x="830" y="447" />
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb8_di" bpmnElement="fdb8">
        <di:waypoint x="930" y="447" />
        <di:waypoint x="960" y="447" />
        <di:waypoint x="960" y="207" />
        <di:waypoint x="1005" y="207" />
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb9_di" bpmnElement="fdb9">
        <di:waypoint x="1055" y="207" />
        <di:waypoint x="1110" y="207" />
        <di:waypoint x="1110" y="577" />
        <di:waypoint x="1130" y="577" />
        <bpmndi:BPMNLabel><dc:Bounds x="1061" y="187" width="21" height="14" /></bpmndi:BPMNLabel>
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb10_di" bpmnElement="fdb10">
        <di:waypoint x="1055" y="207" />
        <di:waypoint x="1260" y="207" />
        <di:waypoint x="1260" y="77" />
        <di:waypoint x="1280" y="77" />
        <bpmndi:BPMNLabel><dc:Bounds x="1061" y="213" width="17" height="14" /></bpmndi:BPMNLabel>
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb11_di" bpmnElement="fdb11">
        <di:waypoint x="1230" y="577" />
        <di:waypoint x="1260" y="577" />
        <di:waypoint x="1260" y="77" />
        <di:waypoint x="1280" y="77" />
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb12_di" bpmnElement="fdb12">
        <di:waypoint x="1380" y="77" />
        <di:waypoint x="1410" y="77" />
        <di:waypoint x="1410" y="207" />
        <di:waypoint x="1430" y="207" />
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb13_di" bpmnElement="fdb13">
        <di:waypoint x="1530" y="207" />
        <di:waypoint x="1612" y="207" />
      </bpmndi:BPMNEdge>
    </bpmndi:BPMNPlane>
  </bpmndi:BPMNDiagram>
</bpmn2:definitions>

Frequently asked questions

Where would the 72 hour deadline attach as a timer in this model?

Attach a timer boundary event to the assessment task, set to 72 hours from breach awareness, with its flow routed to an urgent notification task. That models the legal reality that the clock runs during assessment, not after it, and guarantees the diagram shows a path to the ICO even when analysis overruns.

Why does the non-reportable branch still pass through a documentation task?

UK GDPR requires organisations to record every personal data breach, including the reasoning behind a decision not to notify. Routing the No branch through "Document decision rationale" makes that duty a mandatory step on the path rather than a footnote, so the process cannot complete with an undocumented judgement call.

Should the ICO be a separate pool with a message flow?

That would be more formally precise, since the ICO is an external participant receiving a notification. This model keeps a send task inside one pool for readability, which is a common and acceptable simplification. Add a black box "ICO" pool with one message flow if your audience expects strict participant modelling.

Related BPMN examples

Incident management

An ITIL-style incident management process as a BPMN 2.0 diagram: triage, major incident handling, escalation, and review. Download the .bpmn file free.

Change management

An IT change management process as a BPMN 2.0 swimlane diagram: risk assessment, CAB approval, implementation, and rollback. Free .bpmn download included.

User access request

A user access request process as a BPMN 2.0 diagram: manager approval, parallel provisioning, and an access register update. Download the .bpmn file free.

Password reset

A password reset process as a BPMN 2.0 diagram: MFA self-service, manual verification fallback, and a message wait state. Free .bpmn file download included.

Generate your own version of this diagram

Describe how the process works in your organisation: plain English, meeting notes, a transcript, or a spreadsheet. Swimdraft turns it into a spec-validated BPMN 2.0 diagram you can edit in the browser and export as .bpmn, SVG, or PNG.

Start free

No credit card required