Security questionnaire answers › Incident response
How quickly will you notify us of a data breach? How to answer it in a security questionnaire
Why buyers ask this
Customers have their own legal duties, such as GDPR's 72-hour regulator notice, and need your information fast.
What a strong answer includes
- Commit to a number you can actually keep, such as 24 to 72 hours from confirmation.
- Say who is notified and how (named security contact, email).
- Align with contract and data processing agreement terms.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
We notify affected customers without undue delay and no later than [72 hours] after confirming a personal data breach, via the security contact on file, with the information needed to meet their own obligations.
Evidence to attach
- Incident response plan
- DPA clause
Common mistakes
- A promise shorter than your process can deliver.
- No customer security contact on file.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.