Last updated: August 9, 2024

1. Purpose

The purpose of this Data Breach Policy is to establish a framework for responding to data breaches that may compromise the confidentiality, integrity, or availability of personal data or sensitive company information. This policy aims to minimise the risk of data breaches, ensure prompt identification and management of breaches, and fulfil legal and regulatory obligations.

2. Scope

This policy applies to all employees, contractors, vendors, and third-party service providers who have access to the company's information systems or handle personal data or sensitive information.

3. Definitions

- Data Breach: A security incident that results in unauthorised access, disclosure, alteration, or destruction of personal data or sensitive company information.

- Personal Data: Any information related to an identified or identifiable natural person, such as names, contact details, identification numbers, or any other data that can be linked to an individual.

- Sensitive Information: Confidential company information, including but not limited to intellectual property, financial data, and trade secrets.

4. Preventive Measures

To reduce the likelihood of a data breach, the following measures shall be implemented:

- Access Control: Implement strong authentication and access controls to limit access to sensitive information.

- Encryption: Encrypt sensitive data both at rest and in transit to protect it from unauthorised access.

- Regular Audits: Conduct regular security audits and vulnerability assessments to identify and address potential security risks.

- Employee Training: Provide regular training to employees on data protection best practices and how to recognise potential security threats.

5. Identification and Reporting

- Detection: All employees must be vigilant and report any suspicious activity or potential data breaches to the IT department immediately.

- Reporting: Any data breach or suspected breach must be reported to the Data Protection Officer (DPO) or designated security team within 24 hours of discovery.

- Documentation: The incident must be documented with details including the nature of the breach, affected data, and the potential impact.

6. Response and Containment

- Immediate Actions: Upon identification of a breach, the IT department must take immediate steps to contain the breach, such as isolating affected systems, revoking access rights, and applying necessary security patches.

- Assessment: The DPO or security team will assess the scope and impact of the breach, identifying the type of data involved and the number of affected individuals.

- Notification: If personal data is involved, the company must notify the affected individuals and, if required, relevant regulatory bodies within 72 hours of becoming aware of the breach.

- Mitigation: Implement measures to prevent further data loss, such as recovering compromised data, resetting passwords, and enhancing security controls.

7. Investigation and Documentation

- Root Cause Analysis: Conduct a thorough investigation to determine the root cause of the breach and the effectiveness of the response measures.

- Documentation: All actions taken in response to the breach must be documented, including communication with affected parties and regulatory bodies.

- Reporting: A detailed incident report must be prepared and presented to senior management, outlining the breach, response actions, and recommended improvements.

8. Post-Incident Review and Improvement

- Review: After the breach has been contained, the incident will be reviewed to evaluate the effectiveness of the response and identify lessons learned.

- Policy Updates: Based on the review, this Data Breach Policy and associated procedures may be updated to address any identified gaps or weaknesses.

- Training: Additional training may be provided to employees based on the lessons learned to prevent future breaches.

9. Compliance and Legal Obligations

- Regulatory Compliance: The company must comply with all applicable data protection laws and regulations, including but not limited to the General Data Protection Regulation (GDPR) and local privacy laws.

- Legal Obligations: If the breach involves sensitive information that may lead to legal consequences, the company’s legal team must be consulted immediately to ensure appropriate legal actions are taken.

10. Review and Updates

This Data Breach Policy will be reviewed annually or following any significant data breach incident. Any updates will be communicated to all relevant stakeholders, and appropriate training will be provided.

11. Responsibilities

- Data Protection Officer (DPO): Responsible for overseeing the implementation of this policy, reporting breaches, and ensuring compliance with data protection regulations.

- IT Department: Responsible for implementing preventive measures, detecting breaches, and executing the technical aspects of the breach response.

- Employees: Responsible for following security protocols, reporting suspected breaches, and participating in regular training.

12. Consequences of Non-Compliance

Failure to comply with this policy may result in disciplinary action, including termination of employment or contracts, and may also lead to legal action if negligence is determined to have contributed to the breach.

---

Approval Date: 09/08/2024

Effective Date: 09/08/2024

Next Review Date: 09/08/2025

---