An organisation’s procedure or approach for recording, investigating, containing and mitigating a personal data breach.