Privacy Policy Instruction 047-01-006 Privacy Incident Responsibilities and Breach Response Team

This policy Instruction:

• implements DHS Directive 047-01, “Privacy Policy and Compliance,” and establishes DHS policy, responsibilities, and requirements for responding to all incidents involving personally identifiable information (PII) contained in DHS information (i.e., “privacy incident”/“breach”); and
• establishes the requirement for the Chief Privacy Officer to convene and lead a Breach Response Team (BRT) when a “major incident” that includes PII has occurred, or at the discretion of the Chief Privacy Office.

December 4, 2017