WHY ENGLISH?
Choose the reading job in front of you
This guide turns formal wording into a reliable sequence. Start with the route closest to your situation, then use the grouped contents for the full explanation.
Open the full contents · See the How English Works hub
Full contents
Verify the message
Map the exposed data
Judge the stated risk
Protect each account
English matters when reading a personal data breach notification because the message should answer two questions at once: what happened to the organisation, and what should the affected person do now? Those questions overlap but are not identical. A breach can involve access, disclosure, loss or alteration, and the right protective step depends on which data and systems are involved.
Singapore’s Personal Data Protection Commission explains in its data-breach management guide that notification can help affected individuals take protective action, such as changing passwords or staying alert to scams. The PDPC’s reporting page describes when organisations must notify the Commission and affected people. Readers should also use the Commission’s personal-data protection advice for current individual precautions.
Use the breach map sender, incident, discovery date, incident period, affected system, categories of data, affected people, containment, likely impact, personal action, support, monitoring and update. Then build a separate action line for every affected account. One password change is not a universal response if identity documents, payment data or security answers were involved.
This guide uses data breach notification, affected individual, exposed personal data, unauthorised access, password reset, identity theft, scam alert and account monitoring naturally. It teaches careful response, not cyber-forensics or legal advice. It does not guarantee that a notification is genuine or that listed actions remove every risk.
Verify the sender independently
The breach-notification question is organisation name, official domain and published incident page. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that criminals can imitate a breach notice to collect more data. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: open the organisation’s official site without using the message link. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. a real-sounding subject line is not authentication. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For organisation name, official domain and published incident page, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about organisation name, official domain and published incident page as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
Read the notification date
The breach-notification question is when the message was issued. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that date of notice can be confused with date of incident. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: place every date on a simple timeline. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. a notice sent today may describe access discovered weeks earlier. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For when the message was issued, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about when the message was issued as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
Separate incident and discovery
The breach-notification question is when activity occurred and when it became known. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that organisations may use discovered, confirmed and contained for different stages. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: preserve each stage verb. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. detected on Monday does not mean the intrusion began on Monday. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For when activity occurred and when it became known, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Did You Know? PDPC guidance says effective notification gives affected people an opportunity to protect themselves, including changing passwords or watching for scams. Apply that purpose while you separate incident and discovery.
Identify the affected system
The breach-notification question is portal, vendor, database, device or account. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that a company-wide name can make the scope seem broader or narrower than stated. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: name the exact service mentioned. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. a marketing system incident may not include payment processing. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For portal, vendor, database, device or account, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about portal, vendor, database, device or account as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
List exposed data categories
The breach-notification question is name, contact, identity, account, health or financial information. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that the word personal data is too broad for action. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: make one row per data category. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. an email address and a passport image create different risks. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For name, contact, identity, account, health or financial information, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about name, contact, identity, account, health or financial information as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
Notice what was not affected
The breach-notification question is explicit exclusions supported by the notice. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that absence of a data type can be mistaken for a guarantee. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: record exclusions with the notice date and wording. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. no payment-card data found is not identical to impossible for any later update. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For explicit exclusions supported by the notice, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about explicit exclusions supported by the notice as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
Distinguish encryption and access
The breach-notification question is protected format, key exposure and unauthorised use. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that technical reassurance can be overread without context. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: treat the organisation’s statement as evidence, not a universal conclusion. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. encrypted data may require a different assessment from plain-text records. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For protected format, key exposure and unauthorised use, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about protected format, key exposure and unauthorised use as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
Read affected-person language
The breach-notification question is confirmed, potentially affected or under investigation. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that possibly can be turned into definitely, or vice versa. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: keep the modality exactly. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. you may be affected means action can be sensible while facts remain incomplete. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For confirmed, potentially affected or under investigation, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Did You Know? PDPC guidance says effective notification gives affected people an opportunity to protect themselves, including changing passwords or watching for scams. Apply that purpose while you read affected-person language.
Map likely harm by data
The breach-notification question is scam, impersonation, account takeover or discrimination risk. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that generic fear does not identify the next move. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: connect each data type to a plausible misuse. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. an exposed email and phone number can support convincing impersonation attempts. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For scam, impersonation, account takeover or discrimination risk, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about scam, impersonation, account takeover or discrimination risk as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
Change the right passwords
The breach-notification question is affected account, reused passwords and recovery channels. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that changing an unrelated password can create false confidence. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: start with the breached account and every reused credential. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. a unique password elsewhere does not need replacement merely because it looks similar. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For affected account, reused passwords and recovery channels, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about affected account, reused passwords and recovery channels as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
Use multi-factor authentication
The breach-notification question is available second factor and secure recovery. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that MFA can be enabled while the recovery email remains weak. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: review both sign-in and recovery settings. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. an authenticator protects differently from an SMS code and should be chosen deliberately. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For available second factor and secure recovery, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about available second factor and secure recovery as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
Revoke active sessions
The breach-notification question is logged-in devices, tokens and app access. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that a changed password may not close every existing session. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: use the service’s security page to sign out where appropriate. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. remove unfamiliar connected applications. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For logged-in devices, tokens and app access, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about logged-in devices, tokens and app access as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
Watch for targeted phishing
The breach-notification question is breach-themed calls, texts and emails. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that attackers can use correct personal details to sound trustworthy. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: verify through a separately obtained channel. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. knowing your address does not prove a caller is the organisation. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For breach-themed calls, texts and emails, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Did You Know? PDPC guidance says effective notification gives affected people an opportunity to protect themselves, including changing passwords or watching for scams. Apply that purpose while you watch for targeted phishing.
Protect identity documents
The breach-notification question is NRIC, passport or image exposure. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that ordinary password advice may be insufficient. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: follow current official and issuer-specific steps. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. monitor for impersonation and do not send another identity image to an unverified helper. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For NRIC, passport or image exposure, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about NRIC, passport or image exposure as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
Monitor financial accounts
The breach-notification question is cards, bank accounts and transaction alerts. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that a breach notice may not know what later fraud will look like. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: use official account channels and report unfamiliar activity promptly. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. do not move funds because a caller claims a safe account is required. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For cards, bank accounts and transaction alerts, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about cards, bank accounts and transaction alerts as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
Interpret free monitoring offers
The breach-notification question is provider, duration, enrolment and data requested. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that a protective offer can itself require sensitive registration. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: authenticate the offer and read its scope. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. credit monitoring does not prevent every type of identity misuse. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For provider, duration, enrolment and data requested, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about provider, duration, enrolment and data requested as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
Use the support channel
The breach-notification question is dedicated hotline, case form and reference. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that ordinary customer service may not see the incident file. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: quote the notice and ask a narrow question. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. Was my identity-document image included in the affected categories?. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For dedicated hotline, case form and reference, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about dedicated hotline, case form and reference as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
Keep an evidence log
The breach-notification question is notification, actions, suspicious contacts and reports. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that stress makes dates and channels hard to reconstruct. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: save a concise incident journal. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. record the number called using the organisation’s official page. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For notification, actions, suspicious contacts and reports, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Did You Know? PDPC guidance says effective notification gives affected people an opportunity to protect themselves, including changing passwords or watching for scams. Apply that purpose while you keep an evidence log.
Read updates as changed evidence
The breach-notification question is new scope, revised dates and completed investigation. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that the first notice can become mentally fixed even after facts change. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: compare each update against the earlier notice. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. an expanded affected period should trigger a fresh account check. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For new scope, revised dates and completed investigation, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about new scope, revised dates and completed investigation as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
Separate apology from remedy
The breach-notification question is acknowledgement, explanation and concrete support. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that warm language can obscure what the organisation will actually do. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: list promised actions independently. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. we are sorry is not the same as providing monitoring or replacing a credential. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For acknowledgement, explanation and concrete support, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about acknowledgement, explanation and concrete support as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
Escalate urgent harm
The breach-notification question is active takeover, fraud, threats or vulnerable-person risk. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that a general reading checklist may be too slow for live harm. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: use current official emergency and reporting channels. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. an account takeover in progress needs immediate service-provider action. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For active takeover, fraud, threats or vulnerable-person risk, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about active takeover, fraud, threats or vulnerable-person risk as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
Improve future data habits
The breach-notification question is unique passwords, minimal sharing and secure records. Put the organisation’s statement in one column and your required personal action in another. This prevents a technical incident summary from being mistaken for a complete safety plan.
The security risk is that the event can be treated as purely the organisation’s problem. Data-breach language often carries uncertainty honestly, so the reader must preserve words such as confirmed, may, potentially and no evidence rather than silently strengthen them.
Take an authenticated action: reduce avoidable exposure without blaming the victim. Use a separately obtained official channel whenever the notification asks you to sign in, pay, disclose identity information or install anything.
Breach example. knowing where identity copies are stored helps later response. The correct response depends on the exposed category and account relationship, not on the emotional intensity of the message.
For unique passwords, minimal sharing and secure records, record the time, official source and completed action. A small incident log reduces repeated decisions and helps you recognise whether a later call or email fits the genuine response process.
Treat helpful-sounding follow-up about unique passwords, minimal sharing and secure records as unverified until authenticated. Breach details can make an impersonator sound unusually convincing.
A worked reading: an email says contact details and a password hash were exposed
Nurul receives a breach notification from a service she uses. Instead of clicking ‘secure your account’, she opens the service’s official website and confirms the incident notice. She marks the event period, the data categories, the statement about hashed passwords and the recommended actions. She remembers that the affected password was reused on one older account.
She changes the password on the breached service and the reused account, enables stronger multi-factor authentication, reviews active sessions and saves the notice. When a caller later quotes her email address and claims to offer compensation, she ends the call and uses the official hotline. English has turned a frightening message into authenticated facts and account-specific actions.
A practical checklist
- Genuine sender and official incident page.
- Notification, incident, discovery and containment dates.
- Affected service or system.
- Every exposed data category.
- Confirmed, possible and excluded scope.
- Organisation containment and support.
- Password, MFA, session and recovery actions.
- Identity and financial monitoring.
- Suspicious contacts and official reports.
- Later updates and evidence log.
Advice for students, parents and young adults
Parents can teach breach literacy without frightening children: use a fictional gaming account and ask which facts are confirmed, which links should not be clicked, and which adult should help. The lesson is controlled action, not secrecy or blame.
Students and young adults should use unique passwords so one breach does not become several. A password manager and multi-factor authentication are practical reading outcomes: the notice becomes a change in system, not merely a worrying email.
Frequently asked questions
Is every breach notification genuine?
No. Verify the incident through the organisation’s official site or a separately obtained contact channel.
What is the first thing I should do?
Authenticate the notice, identify the affected data and follow urgent account-specific steps. Do not send more sensitive data to an unverified contact.
Should I change every password?
Prioritise the affected account and any account that reused the same or related credential. Unique unaffected passwords should be assessed based on the actual scope.
Does no evidence of misuse mean no risk?
Not necessarily. It describes what is known at that time. Follow the stated precautions and later updates.
Can English stop a data breach?
Language alone cannot stop an incident. It helps you authenticate the notice, understand exposure, resist impersonation and take the correct protective steps.
The deeper English lesson
Breach-notification English manages uncertainty. Passive voice can hide the actor but still identify the event; modal verbs show what is possible or confirmed; data-category nouns determine protective action; and timelines separate occurrence, discovery, containment and notification.
Useful next reading
Continue with reading a data privacy notice, spotting phishing messages, understanding cookie consent banners and the How English Works big picture.