Answer
Record the data types, affected people or projects, access period, likely exposure, containment steps, notifications, and decisions made under the applicable privacy law and policy.
Explanation
A breach record should support both response and later accountability.