What is data breach review?
A data breach review is the process of identifying, extracting, and reporting personally identifiable information (PII) and protected health information (PHI) inside a corpus of compromised documents. The end product is not a production for opposing counsel — it’s a notification list: a deduped, validated set of affected individuals that the breached organization is legally required to notify.
Most US states, and every major regulator (HHS, FTC, GDPR supervisory authorities), impose tight timelines from the date of discovery. That clock is the most important variable in any breach engagement.
How it differs from litigation review
Both review types share infrastructure — secure platforms, vetted reviewers, project management overhead — but the work itself looks different. The single biggest divergence is what each review is producing.
| Dimension | Data breach review | Litigation review |
|---|---|---|
| Primary output | Notification list of affected individuals | Production set responsive to discovery requests |
| Coding decision | PII / PHI extraction + entity resolution | Relevance, privilege, confidentiality |
| Pace | Compressed, regulator-driven deadlines | Phased over weeks or months |
| QC focus | Recall — missing a person creates legal exposure | Precision — overproduction creates risk |
| Tooling | Redaction, OCR, entity recognition, dedup | TAR/CAL, threading, privilege logging |
| Reviewer profile | Detail-oriented, fast, comfortable with PII patterns | Bar-admitted attorneys for privilege |
Staffing & throughput
Breach reviews need elastic staffing. A typical engagement ramps from zero to 60 reviewers in under a week, runs hot for two to four weeks, then dissolves. Litigation review staffs more steadily over a longer arc.
Three things to demand from your staffing partner
- A vetted bench, not a job board. Reviewers who have done breach work before are 30–40% faster on the same protocol than first-timers. Look for documented breach experience in the bench profile.
- Time-zone coverage. Major breaches don’t wait for a 9–5 work day. A partner with reviewers across at least two US time zones (and ideally one offshore for follow-the-sun coverage) shortens the calendar.
- Language coverage. Multinationals breach multinationally. Confirm fluency in your top three exposure languages before signing.
Tooling & workflow
Most modern review platforms (Relativity, Reveal, DISCO) ship breach-aware workflows now, but the integration with your protocol still matters. Specifically: how the platform handles entity resolution across documents (the same individual mentioned in 12 emails should resolve to one notification), and how redaction stacks with PII tagging.
If your partner is platform-agnostic, that’s an asset — they can match the tooling to the matter, not the other way around.
Quality control
QC for breach is a recall problem. Standard practice is layered: a 100% reviewer pass, a sample-based QC pass against a target accuracy (typically 99%+), and a final audit pass on edge cases (foreign language, handwritten, low-quality OCR). For matters with regulator scrutiny, add a privacy attorney sign-off on the final list.
Picking the right partner
Look for a partner that can answer four questions clearly:
- How many breach reviews have you run, and what was the average ramp time?
- What’s your QC accuracy on the last five engagements?
- How do you handle entity resolution across documents?
- What’s your offshore coverage and language depth?
If those answers come back vague, keep looking. Schedule a consultation with our team to walk through your specific matter.