Which document is essential to have in place before an incident occurs to ensure legal and regulatory compliance regarding data privacy and breach notification?