Power Automate workflow · Compliance

Personal data breach logging and notification workflow

Staff report a suspected breach in Teams; the DPO triages, the response team is assembled and notification deadlines are tracked.

TriggerMicrosoft Forms or Teams message extension: 'Report a data incident'
ConnectorsMicrosoft Forms · SharePoint · Microsoft Teams · Office 365 Outlook
CategoryCompliance

The problem

Since the PDPA amendments introduced mandatory breach notification, there is no clear process to log, assess and notify in time.

The outcome

A timestamped incident log, an assembled response team within minutes, and deadline reminders for notifying the Commissioner and affected individuals.

Before you start

  • An incident list and a private Teams channel for the response team.
  • Your notification thresholds and deadlines confirmed with legal (the PDPA amendments set a 72-hour window for notifying the Commissioner).

Build it step by step

  1. Report — Anyone can report; capture what, when discovered, systems and data types involved.
  2. Triage — Post an adaptive card to the DPO to classify severity.
  3. Mobilise — For significant incidents, create a Teams channel post, Planner tasks and a deadline 72 hours from discovery.
    Expression / setting
    addHours(triggerOutputs()?['body/DiscoveredAt'], 72)
  4. Remind — Reminders at 24h, 48h and 66h until the notification is marked sent.
  5. Evidence — Generate a PDF incident report from the list item for the record.

Connector action names are shown as they appear in Power Automate at the time of writing; Microsoft and Adobe occasionally rename actions or add new versions.

Error handling

  • Use discovery time, not report time, for the deadline — and make the field mandatory.

Licensing

  • Standard connectors.

Variations

  • Integrate Microsoft Sentinel or Defender alerts as an additional trigger.

Common in: Banking · Healthcare · Insurance · Retail