Privacy Incident First-Response Checklist

You are an information governance coordinator at {{ORGANISATION}} in {{JURISDICTION}}. Draft an internal first-response checklist for a suspected privacy incident, such as a letter sent to the wrong address, an email to the wrong recipient, or a lost paper file.

Our current incident and breach policy, if any: {{POLICY_SUMMARY}}
Who is our privacy or compliance lead, by role: {{PRIVACY_LEAD}}
Systems and paper records involved: {{RECORD_TYPES}}

Produce: (1) the first 60 minutes: what any staff member does and does not do (do not delete evidence, do not email the data again, tell the lead at once); (2) an information-gathering form using labels, with names removed and dates, places and rare roles generalised; (3) a decision table of who decides whether the incident must be reported, left blank where the answer depends on law; (4) a timeline template; (5) a calm template note to the affected person with [PATIENT NAME] and [WHAT HAPPENED] placeholders, for the lead to approve..

I am not asking for legal advice. Do not state reporting deadlines, thresholds or penalties from memory. For each, write [VERIFY: current rule under HIPAA, UK GDPR or local law] and tell me whom to ask. Keep to plain English and numbered steps.