A tabletop exercise run against your own incident-response playbook — or building that playbook first, if one doesn't exist yet — to test whether Section 8(6)'s notification obligations would actually be met if a breach happened today. The point isn't a document review; it's finding out, under a realistic simulated scenario, where the plan actually breaks.
A plan that looks complete in a document can still fall apart the moment a team actually has to run it.
Whether a real, usable playbook exists, and building one from scratch where it doesn't.
Running your team through a realistic breach scenario to see how the plan actually holds up under pressure, not on paper.
Whether the organisation could identify, assess and notify within the Act's required timelines.
Whether everyone involved actually knows their role during an incident, not just whether a document says so.
Whether the drafts needed to notify the Board, affected Data Principals, and the Data Protection Board already exist and are ready to use.
What worked, what stalled, and where the notification timeline actually broke down.
Recurring simulations, run on a schedule, are scoped separately as part of the Incident Response Retainer.
Assess the existing plan, or draft one where none exists.
Nothing gets simulated against a plan that isn't real yet — this stage makes sure one exists first.
Build a realistic breach scenario specific to your systems and data.
Not a generic scenario — built around the systems and data your organisation actually has.
Run the exercise live, observing how the team actually responds.
The centrepiece of the assessment — a live run, not a paper walkthrough.
Identify where the response broke down and correct the playbook accordingly.
The playbook gets updated with what the simulation actually revealed, not left as-is.
30 minutes to talk through scope, no obligation.
Book a Consultation