Abstract: A method of managing a data breach is implemented in a management platform, preferably as an Internet-accessible service. The method begins upon receipt of data defining a data loss event associated with an organization. The data is processed by a rules engine against a corpus of data sets. A data set is associated with a business requirement (e.g., a State regulation) and encodes a decision tree defining predefined responses prescribed by the business requirement upon occurrence of a data breach. As a result of the processing, a privacy impact assessment defining an impact of the data loss event may be generated. The data loss event may then be escalated into an incident. The incident has associated therewith a response plan that is generated as a function of at least one characteristic of the data loss event and at least one response in the set of predefined responses.