History

Purpose

This Procedure describes how we assess a personal data breach and notify the supervisory authority, the people concerned, and our customers in the time that Regulation (EU) 2016/679 allows.

Scope

It applies to every breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data that Tidewell IT processes, whether as controller or as processor.

Roles

• Data Protection Officer: owns this Procedure, assesses each breach, and decides on notification.
• Incident Coordinator: leads containment and starts the Cbw clock when it applies.
• Service Desk: receives reports and opens the Incident.
• Management Board: is informed of every breach that is notified.

Procedure

Awareness and reporting

1. Anyone who suspects a breach reports it at once to the Service Desk and to the Data Protection Officer.
2. Tidewell IT becomes aware of a breach at the moment there is reasonable certainty that personal data was compromised. The 72-hour deadline runs from that moment.
3. The Service Desk opens an Incident marked as personal data.

Containment and assessment

1. The Incident Coordinator contains the breach with the steps of the Incident Handling Procedure.
2. The Data Protection Officer assesses the risk to people within 24 hours of detection. The assessment looks at the kind and amount of data, how easily people can be identified, and the harm that may follow.
3. The Data Protection Officer decides, and records the decision with its reasons. There are three outcomes: record the breach only, notify the authority, or notify the authority and the people.

Notification

1. When the breach is likely to risk people's rights, we notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware. A late notification states the reason for the delay.
2. The notification holds the four contents of Article 33(3): the nature of the breach, the contact point, the likely consequences, and the measures taken or proposed.
3. The contact point is the Data Protection Officer at privacy@tidewell-it.example.
4. When the risk to people is high, we tell the individuals concerned without undue delay, in clear language, and we advise them what to do.
5. When we act as processor, the Data Protection Officer tells the affected customer without undue delay and within 24 hours, and gives the customer the facts it needs to meet its own duty.
6. When the breach is also a significant incident, the Incident Coordinator starts the Cbw clock: early warning within 24 hours, incident notification within 72 hours, and the final report within one month.

Closing

1. The Data Protection Officer completes the breach record, whether or not a notification was made, and keeps it for 5 years.
2. The review of the Incident raises Findings for the causes and the measures that remain.

Records

• The Incident and the breach record with the risk assessment and the decision.
• A copy of each notification and the confirmation of receipt.
• The messages to individuals and customers.

Related documents

• Incident Response Policy
• Personal Data Protection Policy
• Incident Handling Procedure

Review

The Data Protection Officer reviews this Procedure at least once a year and after a significant change, and after every breach that is notified.