Free Data Breaches & Incident Management Templates

This document outlines a company's approach to security, detailing how customer data is protected and how security concerns are handled. It provides clear channels for customers to report account attacks and for security researchers to disclose vulnerabilities through a bug bounty program. The company commits to investigating and resolving issues, ensuring proper credit for discoveries.

This Data Protection Policy outlines a company's commitment to safeguarding personal data and respecting individual privacy rights. It details how the company collects, processes, stores, and manages personal data in compliance with various data protection laws and regulations. The policy also defines responsibilities for employees, contractors, and the Data Protection Officer, and covers data subject rights and breach response procedures.

This Privacy Policy template outlines how a company collects, uses, and shares personal information from its users through its website and services. It details various data collection methods, including direct input and automatic tracking via cookies, and explains the legal bases for processing data. The policy also covers user rights, particularly those under GDPR, international data transfers, and security measures.

This document outlines GitHub's policy and process for requesting the removal of private information from repositories. It defines what constitutes "private information" for removal purposes, such as access credentials or sensitive organizational data, and details the steps a complainant must follow to submit a valid removal request. The policy also clarifies what types of content are not appropriate for this specific removal process.

This document outlines a company's policy on personal data protection, detailing how personal data is collected, processed, stored, and secured. It emphasizes compliance with the EU General Data Protection Regulation (GDPR) and sets forth principles for data handling, employee obligations, and procedures for data breaches and inquiries. The policy also addresses the use of data processors and international data transfers.

This document is a Business Associate Agreement (BAA) designed to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA) regulations concerning Protected Health Information (PHI). It outlines the specific obligations of a Provider (acting as a Business Associate or Subcontractor) and a Company (acting as a Business Associate or Covered Entity) regarding the use, disclosure, and safeguarding of PHI. The agreement incorporates standard terms and allows for customization through a key terms cover page.

This document outlines GitHub's policy and process for removing private, high-risk information, such as exposed access credentials or sensitive personal data, from its repositories. It details what qualifies as "private information" and guides users on how to submit a removal request, including the necessary information and the steps GitHub will take. The policy also clarifies what types of content are not covered by this specific removal process.

This document describes the GitHub Security Incident Response Team (SIRT), outlining its mission to protect GitHub's platform and user data by maintaining confidentiality, integrity, and availability. It provides essential contact information, details the team's operational policies, and explains the scope of its incident response and proactive security activities. The document also guides users and customers on how to report vulnerabilities and access support.

This document provides an overview of the security measures implemented by a service provider to protect user data. It details practices such as data encryption in transit and at rest, redundancy for systems, physical security of servers, regular infrastructure updates, and protection of billing information. The document emphasizes the company's commitment to data security and its long history in business.

This document is a Data Processing Agreement (DPA) designed to supplement an underlying agreement between a Customer and a Provider. It outlines the terms for processing personal data, defining roles such as Controller, Processor, and Subprocessor. The DPA details obligations related to data security, international data transfers under various regulations (e.g., GDPR, UK GDPR, CCPA), and incident response, incorporating standard terms from Common Paper DPA Standard Terms Version 1.1.