Meeting minutes
Data Breach
DataBreach - 3 stages - discovery, ongoing investigation, final report
Data Breach Investigation communication
How do we specify things such as I don't know it yet? Not Available to indicate we don't have that information yet; careful about labels e.g. to say Unavailable, waiting for response from vendor
DPC form
- how to indicate cross-border data subject or cross-border personal data? For data, we can figure out via querying to identify transfer and storage with their locations and jurisdictions
- how to specify main establishment, how to specify main supervisory authority?
two options - we only focus on data breach information and leave out company specific information; or we stop data breach and first do main establishment etc.
we decide to focus on data breach relation information, and look for other external vocabularies or efforts to model company information e.g. subsidiaries or GIST