Breach notification draft communications

Identifies documents containing references to breach notification draft communications in international contexts. Sensitive pre-release breach communications may contain personal-impact data — incident scope, affected individuals and groups, regulator engagement, and unverified legal conclusions; the matched phrases are not themselves personally identifiable information.

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

category-aware structural regex with anchor and context constraints replaces phrase-only detection. Added context gating and exclusion rules improve precision and reduce incidental matches.

Detection quality

Topic false positive

Jurisdictions

global

Regulations

GDPR

Data categories

pii

Scope

wide

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?is)\b(?:breach\s+notification\s+draft\s+communications|breach\s+notification|data\s+breach|notifiable\s+data\s+breach|affected\s+individuals|notification\s+letter|breach\s+assessment|incident\s+response|privacy\s+commissioner|mandatory\s+reporting|eligible\s+data\s+breach|remediation\s+steps)\b

Corroborative evidence keywords

breach notification draft communications, breach, notification, draft, communications, corporate, legal, governance

Proximity: 300 characters

Should match

• breach notification draft communications — Primary topic phrase match
• breach notification — Case-insensitive topic phrase match
• data breach — Alternative topic phrase match
• notifiable data breach — Additional topic phrase match

Should not match

• unrelated generic text without domain phrases — No relevant topic phrases present
• placeholder value 12345 — Random text should not match topic-specific regex
• board policy — Generic word pair from old broad template should not match

Known false positives

• Common words and phrases related to breach notification draft communications appearing in policy documents, training materials, HR templates, or compliance guidelines without actual personal data. Mitigation: Require corroborative evidence keywords within the proximity window to confirm sensitive data context rather than general discussion.
• In English (as the primary international business language), similar terminology used in formal or administrative contexts (education, professional documentation) that does not constitute sensitive data collection. Mitigation: Layer with additional contextual signals such as structured identifiers, form fields, or database column headers to distinguish sensitive records from general references.
• High-frequency pattern matches in large document corpora due to broad regex anchors. Expected match rate is significantly higher than specific identifier patterns. Mitigation: Tune confidence thresholds for bulk scanning. Consider using this pattern primarily as a pre-filter with secondary validation.

References

• https://www.oaic.gov.au/privacy/notifiable-data-breaches
• https://www.oaic.gov.au/privacy/privacy-guidance-for-organisations-and-government-agencies/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response