<?xml version="1.0" encoding="UTF-8"?>
<bpmn2:definitions xmlns:bpmn2="http://www.omg.org/spec/BPMN/20100524/MODEL" xmlns:bpmndi="http://www.omg.org/spec/BPMN/20100524/DI" xmlns:dc="http://www.omg.org/spec/DD/20100524/DC" xmlns:di="http://www.omg.org/spec/DD/20100524/DI" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" id="Definitions_1" targetNamespace="http://bpmn.io/schema/bpmn" exporter="swimdraft" exporterVersion="1.0">
  <bpmn2:collaboration id="Collaboration_1">
    <bpmn2:participant id="pool_db" name="Data breach response" processRef="Process_pool_db" />
  </bpmn2:collaboration>
  <bpmn2:process id="Process_pool_db" isExecutable="false">
    <bpmn2:laneSet id="LaneSet_pool_db">
      <bpmn2:lane id="lane_db_sec" name="Security operations">
        <bpmn2:flowNodeRef>start_db</bpmn2:flowNodeRef>
        <bpmn2:flowNodeRef>t_db_contain</bpmn2:flowNodeRef>
        <bpmn2:flowNodeRef>t_db_remed</bpmn2:flowNodeRef>
      </bpmn2:lane>
      <bpmn2:lane id="lane_db_dpo" name="Data protection officer">
        <bpmn2:flowNodeRef>t_db_assess</bpmn2:flowNodeRef>
        <bpmn2:flowNodeRef>g_db_report</bpmn2:flowNodeRef>
        <bpmn2:flowNodeRef>t_db_ico</bpmn2:flowNodeRef>
        <bpmn2:flowNodeRef>t_db_doc</bpmn2:flowNodeRef>
        <bpmn2:flowNodeRef>g_db_risk</bpmn2:flowNodeRef>
        <bpmn2:flowNodeRef>t_db_review</bpmn2:flowNodeRef>
        <bpmn2:flowNodeRef>end_db</bpmn2:flowNodeRef>
      </bpmn2:lane>
      <bpmn2:lane id="lane_db_legal" name="Legal">
        <bpmn2:flowNodeRef>t_db_legal</bpmn2:flowNodeRef>
      </bpmn2:lane>
      <bpmn2:lane id="lane_db_comms" name="Communications">
        <bpmn2:flowNodeRef>t_db_inform</bpmn2:flowNodeRef>
      </bpmn2:lane>
    </bpmn2:laneSet>
    <bpmn2:startEvent id="start_db" name="Breach suspected">
      <bpmn2:outgoing>fdb1</bpmn2:outgoing>
    </bpmn2:startEvent>
    <bpmn2:task id="t_db_contain" name="Contain affected systems">
      <bpmn2:incoming>fdb1</bpmn2:incoming>
      <bpmn2:outgoing>fdb2</bpmn2:outgoing>
    </bpmn2:task>
    <bpmn2:userTask id="t_db_assess" name="Assess scope and data types">
      <bpmn2:incoming>fdb2</bpmn2:incoming>
      <bpmn2:outgoing>fdb3</bpmn2:outgoing>
    </bpmn2:userTask>
    <bpmn2:exclusiveGateway id="g_db_report" name="Reportable to the ICO?" default="fdb5">
      <bpmn2:incoming>fdb3</bpmn2:incoming>
      <bpmn2:outgoing>fdb4</bpmn2:outgoing>
      <bpmn2:outgoing>fdb5</bpmn2:outgoing>
    </bpmn2:exclusiveGateway>
    <bpmn2:sendTask id="t_db_ico" name="Notify ICO within 72 hours">
      <bpmn2:incoming>fdb4</bpmn2:incoming>
      <bpmn2:outgoing>fdb6</bpmn2:outgoing>
    </bpmn2:sendTask>
    <bpmn2:task id="t_db_doc" name="Document decision rationale">
      <bpmn2:incoming>fdb5</bpmn2:incoming>
      <bpmn2:outgoing>fdb7</bpmn2:outgoing>
    </bpmn2:task>
    <bpmn2:userTask id="t_db_legal" name="Advise on notification duties">
      <bpmn2:incoming>fdb6</bpmn2:incoming>
      <bpmn2:incoming>fdb7</bpmn2:incoming>
      <bpmn2:outgoing>fdb8</bpmn2:outgoing>
    </bpmn2:userTask>
    <bpmn2:exclusiveGateway id="g_db_risk" name="High risk to individuals?" default="fdb10">
      <bpmn2:incoming>fdb8</bpmn2:incoming>
      <bpmn2:outgoing>fdb9</bpmn2:outgoing>
      <bpmn2:outgoing>fdb10</bpmn2:outgoing>
    </bpmn2:exclusiveGateway>
    <bpmn2:sendTask id="t_db_inform" name="Inform affected individuals">
      <bpmn2:incoming>fdb9</bpmn2:incoming>
      <bpmn2:outgoing>fdb11</bpmn2:outgoing>
    </bpmn2:sendTask>
    <bpmn2:task id="t_db_remed" name="Remediate root cause">
      <bpmn2:incoming>fdb10</bpmn2:incoming>
      <bpmn2:incoming>fdb11</bpmn2:incoming>
      <bpmn2:outgoing>fdb12</bpmn2:outgoing>
    </bpmn2:task>
    <bpmn2:userTask id="t_db_review" name="Hold lessons learnt review">
      <bpmn2:incoming>fdb12</bpmn2:incoming>
      <bpmn2:outgoing>fdb13</bpmn2:outgoing>
    </bpmn2:userTask>
    <bpmn2:endEvent id="end_db" name="Breach closed">
      <bpmn2:incoming>fdb13</bpmn2:incoming>
    </bpmn2:endEvent>
    <bpmn2:sequenceFlow id="fdb1" sourceRef="start_db" targetRef="t_db_contain" />
    <bpmn2:sequenceFlow id="fdb2" sourceRef="t_db_contain" targetRef="t_db_assess" />
    <bpmn2:sequenceFlow id="fdb3" sourceRef="t_db_assess" targetRef="g_db_report" />
    <bpmn2:sequenceFlow id="fdb4" name="Yes" sourceRef="g_db_report" targetRef="t_db_ico">
      <bpmn2:conditionExpression xsi:type="bpmn2:tFormalExpression">Yes</bpmn2:conditionExpression>
    </bpmn2:sequenceFlow>
    <bpmn2:sequenceFlow id="fdb5" name="No" sourceRef="g_db_report" targetRef="t_db_doc" />
    <bpmn2:sequenceFlow id="fdb6" sourceRef="t_db_ico" targetRef="t_db_legal" />
    <bpmn2:sequenceFlow id="fdb7" sourceRef="t_db_doc" targetRef="t_db_legal" />
    <bpmn2:sequenceFlow id="fdb8" sourceRef="t_db_legal" targetRef="g_db_risk" />
    <bpmn2:sequenceFlow id="fdb9" name="Yes" sourceRef="g_db_risk" targetRef="t_db_inform">
      <bpmn2:conditionExpression xsi:type="bpmn2:tFormalExpression">Yes</bpmn2:conditionExpression>
    </bpmn2:sequenceFlow>
    <bpmn2:sequenceFlow id="fdb10" name="No" sourceRef="g_db_risk" targetRef="t_db_remed" />
    <bpmn2:sequenceFlow id="fdb11" sourceRef="t_db_inform" targetRef="t_db_remed" />
    <bpmn2:sequenceFlow id="fdb12" sourceRef="t_db_remed" targetRef="t_db_review" />
    <bpmn2:sequenceFlow id="fdb13" sourceRef="t_db_review" targetRef="end_db" />
  </bpmn2:process>
  <bpmndi:BPMNDiagram id="BPMNDiagram_1">
    <bpmndi:BPMNPlane id="BPMNPlane_1" bpmnElement="Collaboration_1">
      <bpmndi:BPMNShape id="pool_db_di" bpmnElement="pool_db" isHorizontal="true">
        <dc:Bounds x="20" y="20" width="1720" height="630" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="lane_db_sec_di" bpmnElement="lane_db_sec" isHorizontal="true">
        <dc:Bounds x="50" y="20" width="1690" height="130" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="lane_db_dpo_di" bpmnElement="lane_db_dpo" isHorizontal="true">
        <dc:Bounds x="50" y="150" width="1690" height="240" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="lane_db_legal_di" bpmnElement="lane_db_legal" isHorizontal="true">
        <dc:Bounds x="50" y="390" width="1690" height="130" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="lane_db_comms_di" bpmnElement="lane_db_comms" isHorizontal="true">
        <dc:Bounds x="50" y="520" width="1690" height="130" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="start_db_di" bpmnElement="start_db">
        <dc:Bounds x="112" y="59" width="36" height="36" />
        <bpmndi:BPMNLabel><dc:Bounds x="85" y="101" width="91" height="14" /></bpmndi:BPMNLabel>
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="t_db_contain_di" bpmnElement="t_db_contain">
        <dc:Bounds x="230" y="37" width="100" height="80" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="t_db_assess_di" bpmnElement="t_db_assess">
        <dc:Bounds x="380" y="167" width="100" height="80" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="g_db_report_di" bpmnElement="g_db_report">
        <dc:Bounds x="555" y="182" width="50" height="50" />
        <bpmndi:BPMNLabel><dc:Bounds x="522" y="162" width="116" height="14" /></bpmndi:BPMNLabel>
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="t_db_ico_di" bpmnElement="t_db_ico">
        <dc:Bounds x="680" y="167" width="100" height="80" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="t_db_doc_di" bpmnElement="t_db_doc">
        <dc:Bounds x="680" y="277" width="100" height="80" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="t_db_legal_di" bpmnElement="t_db_legal">
        <dc:Bounds x="830" y="407" width="100" height="80" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="g_db_risk_di" bpmnElement="g_db_risk">
        <dc:Bounds x="1005" y="182" width="50" height="50" />
        <bpmndi:BPMNLabel><dc:Bounds x="971" y="162" width="118" height="14" /></bpmndi:BPMNLabel>
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="t_db_inform_di" bpmnElement="t_db_inform">
        <dc:Bounds x="1130" y="537" width="100" height="80" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="t_db_remed_di" bpmnElement="t_db_remed">
        <dc:Bounds x="1280" y="37" width="100" height="80" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="t_db_review_di" bpmnElement="t_db_review">
        <dc:Bounds x="1430" y="167" width="100" height="80" />
      </bpmndi:BPMNShape>
      <bpmndi:BPMNShape id="end_db_di" bpmnElement="end_db">
        <dc:Bounds x="1612" y="189" width="36" height="36" />
        <bpmndi:BPMNLabel><dc:Bounds x="1594" y="231" width="72" height="14" /></bpmndi:BPMNLabel>
      </bpmndi:BPMNShape>
      <bpmndi:BPMNEdge id="fdb1_di" bpmnElement="fdb1">
        <di:waypoint x="148" y="77" />
        <di:waypoint x="230" y="77" />
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb2_di" bpmnElement="fdb2">
        <di:waypoint x="330" y="77" />
        <di:waypoint x="360" y="77" />
        <di:waypoint x="360" y="207" />
        <di:waypoint x="380" y="207" />
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb3_di" bpmnElement="fdb3">
        <di:waypoint x="480" y="207" />
        <di:waypoint x="555" y="207" />
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb4_di" bpmnElement="fdb4">
        <di:waypoint x="605" y="207" />
        <di:waypoint x="680" y="207" />
        <bpmndi:BPMNLabel><dc:Bounds x="611" y="187" width="21" height="14" /></bpmndi:BPMNLabel>
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb5_di" bpmnElement="fdb5">
        <di:waypoint x="605" y="207" />
        <di:waypoint x="660" y="207" />
        <di:waypoint x="660" y="317" />
        <di:waypoint x="680" y="317" />
        <bpmndi:BPMNLabel><dc:Bounds x="611" y="213" width="17" height="14" /></bpmndi:BPMNLabel>
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb6_di" bpmnElement="fdb6">
        <di:waypoint x="780" y="207" />
        <di:waypoint x="810" y="207" />
        <di:waypoint x="810" y="447" />
        <di:waypoint x="830" y="447" />
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb7_di" bpmnElement="fdb7">
        <di:waypoint x="780" y="317" />
        <di:waypoint x="810" y="317" />
        <di:waypoint x="810" y="447" />
        <di:waypoint x="830" y="447" />
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb8_di" bpmnElement="fdb8">
        <di:waypoint x="930" y="447" />
        <di:waypoint x="960" y="447" />
        <di:waypoint x="960" y="207" />
        <di:waypoint x="1005" y="207" />
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb9_di" bpmnElement="fdb9">
        <di:waypoint x="1055" y="207" />
        <di:waypoint x="1110" y="207" />
        <di:waypoint x="1110" y="577" />
        <di:waypoint x="1130" y="577" />
        <bpmndi:BPMNLabel><dc:Bounds x="1061" y="187" width="21" height="14" /></bpmndi:BPMNLabel>
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb10_di" bpmnElement="fdb10">
        <di:waypoint x="1055" y="207" />
        <di:waypoint x="1260" y="207" />
        <di:waypoint x="1260" y="77" />
        <di:waypoint x="1280" y="77" />
        <bpmndi:BPMNLabel><dc:Bounds x="1061" y="213" width="17" height="14" /></bpmndi:BPMNLabel>
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb11_di" bpmnElement="fdb11">
        <di:waypoint x="1230" y="577" />
        <di:waypoint x="1260" y="577" />
        <di:waypoint x="1260" y="77" />
        <di:waypoint x="1280" y="77" />
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb12_di" bpmnElement="fdb12">
        <di:waypoint x="1380" y="77" />
        <di:waypoint x="1410" y="77" />
        <di:waypoint x="1410" y="207" />
        <di:waypoint x="1430" y="207" />
      </bpmndi:BPMNEdge>
      <bpmndi:BPMNEdge id="fdb13_di" bpmnElement="fdb13">
        <di:waypoint x="1530" y="207" />
        <di:waypoint x="1612" y="207" />
      </bpmndi:BPMNEdge>
    </bpmndi:BPMNPlane>
  </bpmndi:BPMNDiagram>
</bpmn2:definitions>