Data Incident Response Plan

Document status: working legal template. Before publication, fill in the details, verify the actual service architecture, and have the text reviewed by a lawyer practicing in the Republic of Uzbekistan.

Service owner: [LEGAL ENTITY NAME], TIN [TIN], address: [ADDRESS].
Service: Belgi.ai, [DOMAIN].
Version: [VERSION NUMBER] dated [DATE].
Contacts: [EMAIL], [PHONE].

Levels

P1 — confirmed breach, compromise of a privileged account or critical unavailability; P2 — limited unauthorized access; P3 — attempt or violation without confirmed harm.

Process

1. Receive the signal and open an incident record.
2. Preserve evidence and appoint a lead.
3. Restrict access, isolate the system, revoke keys.
4. Determine data categories, subjects, period, causes and recipients.
5. Assess with counsel whether authorities, clients and subjects must be notified.
6. Restore the service, verify integrity, watch for recurrence.
7. Conduct a root-cause review and close corrective actions.

Contacts: security [EMAIL], counsel [EMAIL], management [CONTACT], contractors [LIST]. External communications are made only by an authorized person. A log of decisions and action times is mandatory.