Compliance

This is the Compliance demo. Every visitor shares this company, and it resets every night.

What you change here, everyone sees until the next reset. Email, payments, and the AI models are switched off.

Start your own trial
  • EU GDPR (2016)
  • ISO 27001:2022
  • NIS2
  • NIS2 Netherlands (Cbw, 2026)

Nothing found that matches the search criteria.
Start your own trial
SV
Sam de Vries
sam.devries@tidewell-it.example
Legal

Edit PRO-004

Cancel
Body

Purpose

This Procedure describes how we assess a personal data breach and notify the supervisory authority, the people concerned, and our customers in the time that Regulation (EU) 2016/679 allows.

Scope

It applies to every breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data that Tidewell IT processes, whether as controller or as processor.

Roles

  • Data Protection Officer: owns this Procedure, assesses each breach, and decides on notification.
  • Incident Coordinator: leads containment and starts the Cbw clock when it applies.
  • Service Desk: receives reports and opens the Incident.
  • Management Board: is informed of every breach that is notified.

Procedure

Awareness and reporting

  1. Anyone who suspects a breach reports it at once to the Service Desk and to the Data Protection Officer.
  2. Tidewell IT becomes aware of a breach at the moment there is reasonable certainty that personal data was compromised. The 72-hour deadline runs from that moment.
  3. The Service Desk opens an Incident marked as personal data.

Containment and assessment

  1. The Incident Coordinator contains the breach with the steps of the Incident Handling Procedure.
  2. The Data Protection Officer assesses the risk to people within 24 hours of detection. The assessment looks at the kind and amount of data, how easily people can be identified, and the harm that may follow.
  3. The Data Protection Officer decides, and records the decision with its reasons. There are three outcomes: record the breach only, notify the authority, or notify the authority and the people.

Notification

  1. When the breach is likely to risk people's rights, we notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware. A late notification states the reason for the delay.
  2. The notification holds the four contents of Article 33(3): the nature of the breach, the contact point, the likely consequences, and the measures taken or proposed.
  3. The contact point is the Data Protection Officer at privacy@tidewell-it.example.
  4. When the risk to people is high, we tell the individuals concerned without undue delay, in clear language, and we advise them what to do.
  5. When we act as processor, the Data Protection Officer tells the affected customer without undue delay and within 24 hours, and gives the customer the facts it needs to meet its own duty.
  6. When the breach is also a significant incident, the Incident Coordinator starts the Cbw clock: early warning within 24 hours, incident notification within 72 hours, and the final report within one month.

Closing

  1. The Data Protection Officer completes the breach record, whether or not a notification was made, and keeps it for 5 years.
  2. The review of the Incident raises Findings for the causes and the measures that remain.

Records

  • The Incident and the breach record with the risk assessment and the decision.
  • A copy of each notification and the confirmation of receipt.
  • The messages to individuals and customers.

Related documents

  • Incident Response Policy
  • Personal Data Protection Policy
  • Incident Handling Procedure

Review

The Data Protection Officer reviews this Procedure at least once a year and after a significant change, and after every breach that is notified.
    • — none —
    • PER-001 — Sam de Vries
    • PER-002 — Annelies Verbeek
    • PER-003 — Kasper Hoogland
    • PER-004 — Marloes Brinkman
    • PER-005 — Nadia El Idrissi
    • PER-006 — Lotte van Dijk
    • PER-007 — Thijs Bosman
    • PER-008 — Anika Raghavan
    • PER-009 — Daan Rijnders
    • PER-010 — Eva Lundmark
    • PER-011 — Selim Aydogdu
    • PER-012 — Ioana Vasilescu
    • PER-013 — Finn de Rooij
    • PER-014 — Gerrit Smeenk
    • PER-015 — Wouter Hazelhoff
    • PER-016 — Aisha Rahman
    • PER-017 — Niels Dekker
    • PER-018 — Tariq Rashidi
    • PER-019 — Fleur Maas
    • PER-020 — Hans Overbeek
    • PER-021 — Marit Koster
    • PER-022 — Alessandro Ferrante
    • PER-023 — Yara Visser
    • PER-024 — Lars Ekstedt
    • PER-025 — Amira Khalil
    • PER-026 — Remco Bergsma
    • PER-027 — Roos van Beek
    • PER-028 — Dimitri Volkov
    • PER-029 — Esther Blom
    • PER-030 — Mustafa Karaca
    • PER-031 — Floris Adriaanse
    • PER-032 — Joris Kamphuis
    • PER-033 — Lieke Bakhuizen
    • PER-034 — Charlotte Veldhuis
    • PER-035 — Rik Meinders
    • PER-036 — Elena Marques
    • PER-037 — Judith Haanstra
    • PER-038 — Vera Dijkstra
    • PER-039 — Hanneke Rutten
    • PER-040 — Bram Oosterhuis
    • PER-041 — Stefan Kowalski
    • PER-042 — Imogen Clarke
    • PER-043 — Gustav Lindahl
    • PER-044 — Noah Smit
    • PER-045 — Sofie Claes
    • PER-046 — Marjolein Teunissen
    • PER-047 — Willem-Jan Roest
    • PER-048 — Rosalind Achterberg
    • PER-049 — Mikael Strand
    • PER-050 — Ilse Wiegman
    • PER-051 — Cornelis Vos
    • PER-052 — Patrick Ellison

    Nothing found that matches the search criteria.
    • ROL-001 — ISMS Manager
    • ROL-002 — Internal Auditor
    • ROL-003 — Data Protection Officer
    • ROL-004 — Service Desk Lead
    • ROL-005 — Change Manager
    • ROL-006 — Incident Coordinator
    • ROL-007 — Supplier Manager
    • ROL-008 — HR Lead
    • ROL-009 — Facilities Lead
    • ROL-010 — Management Board

    Nothing found that matches the search criteria.
    Who must read this document?
    Requirements covered by this procedure
    • Art. 5(1)(a) — Lawfulness, fairness and transparency (Mandatory)
    • Art. 5(1)(b) — Purpose limitation (Mandatory)
    • Art. 5(1)(c) — Data minimisation (Mandatory)
    • Art. 5(1)(d) — Accuracy (Mandatory)
    • Art. 5(1)(e) — Storage limitation (Mandatory)
    • Art. 5(1)(f) — Integrity and confidentiality (Mandatory)
    • Art. 6 — Lawfulness of processing (Mandatory)
    • Art. 13-14 — Information to be provided to data subjects (Mandatory)
    • Art. 12 — Transparent communication and exercising rights (Mandatory)
    • Art. 15 — Right of access (Mandatory)
    • Art. 16 — Right to rectification (Mandatory)
    • Art. 17 — Right to erasure ('right to be forgotten') (Mandatory)
    • Art. 18 — Right to restriction of processing (Mandatory)
    • Art. 19 — Notify recipients of rectification, erasure, or restriction (Mandatory)
    • Art. 20 — Right to data portability (Mandatory)
    • Art. 21 — Right to object (Mandatory)
    • Art. 24 — Responsibility of the controller (accountability) (Mandatory)
    • Art. 25 — Data protection by design and by default (Mandatory)
    • Art. 28 — Processor contracts (Mandatory)
    • Art. 30 — Records of processing activities (Mandatory)
    • Art. 32 — Security of processing (Mandatory)
    • Art. 33 — Notification of a personal data breach to the supervisory authority (Mandatory)
    • Art. 34 — Communication of a personal data breach to the data subject (Mandatory)
    • Art. 35 — Data protection impact assessment (DPIA)
    • Art. 37-39 — Data protection officer (DPO)
    • Ch. V — International transfers of personal data
    • 4.1 — Understanding the organisation and its context (Mandatory)
    • 4.2 — Understanding the needs and expectations of interested parties (Mandatory)
    • 4.3 — Determining the scope of the information security management system (Mandatory)
    • 4.4 — Information security management system (Mandatory)
    • 5.1 — Leadership and commitment (Mandatory)
    • 5.2 — Policy (Mandatory)
    • 5.3 — Organisational roles, responsibilities and authorities (Mandatory)
    • 6.1.1 — Actions to address risks and opportunities - general (Mandatory)
    • 6.1.2 — Information security risk assessment (Mandatory)
    • 6.1.3 — Information security risk treatment (Mandatory)
    • 6.2 — Information security objectives and planning to achieve them (Mandatory)
    • 6.3 — Planning of changes (Mandatory)
    • 7.1 — Resources (Mandatory)
    • 7.2 — Competence (Mandatory)
    • 7.3 — Awareness (Mandatory)
    • 7.4 — Communication (Mandatory)
    • 7.5.1 — Documented information - general (Mandatory)
    • 7.5.2 — Creating and updating documented information (Mandatory)
    • 7.5.3 — Control of documented information (Mandatory)
    • 8.1 — Operational planning and control (Mandatory)
    • 8.2 — Information security risk assessment (operational) (Mandatory)
    • 8.3 — Information security risk treatment (operational) (Mandatory)
    • 9.1 — Monitoring, measurement, analysis and evaluation (Mandatory)
    • 9.2.1 — Internal audit - general (Mandatory)
    • 9.2.2 — Internal audit programme (Mandatory)
    • 9.3.1 — Management review - general (Mandatory)
    • 9.3.2 — Management review inputs (Mandatory)
    • 9.3.3 — Management review results (Mandatory)
    • 10.1 — Continual improvement (Mandatory)
    • 10.2 — Nonconformity and corrective action (Mandatory)
    • A.5.1 — Policies for information security
    • A.5.2 — Information security roles and responsibilities
    • A.5.3 — Segregation of duties
    • A.5.4 — Management responsibilities
    • A.5.5 — Contact with authorities
    • A.5.7 — Threat intelligence
    • A.5.8 — Information security in project management
    • A.5.9 — Inventory of information and other associated assets
    • A.5.10 — Acceptable use of information and other associated assets
    • A.5.11 — Return of assets
    • A.5.12 — Classification of information
    • A.5.13 — Labelling of information
    • A.5.14 — Information transfer
    • A.5.15 — Access control
    • A.5.16 — Identity management
    • A.5.17 — Authentication information
    • A.5.18 — Access rights
    • A.5.19 — Information security in supplier relationships
    • A.5.20 — Addressing information security within supplier agreements
    • A.5.21 — Managing information security in the ICT supply chain
    • A.5.22 — Monitoring, review and change management of supplier services
    • A.5.23 — Information security for use of cloud services
    • A.5.24 — Information security incident management planning and preparation
    • A.5.25 — Assessment and decision on information security events
    • A.5.26 — Response to information security incidents
    • A.5.27 — Learning from information security incidents
    • A.5.28 — Collection of evidence
    • A.5.29 — Information security during disruption
    • A.5.30 — ICT readiness for business continuity
    • A.5.31 — Legal, statutory, regulatory and contractual requirements
    • A.5.33 — Protection of records
    • A.5.34 — Privacy and protection of PII
    • A.5.35 — Independent review of information security
    • A.5.36 — Compliance with policies, rules and standards for information security
    • A.5.37 — Documented operating procedures
    • A.6.1 — Screening
    • A.6.2 — Terms and conditions of employment
    • A.6.3 — Information security awareness, education and training
    • A.6.4 — Disciplinary process
    • A.6.5 — Responsibilities after termination or change of employment
    • A.6.6 — Confidentiality or non-disclosure agreements
    • A.6.7 — Remote working
    • A.6.8 — Information security event reporting
    • A.7.1 — Physical security perimeters
    • A.7.2 — Physical entry
    • A.7.3 — Securing offices, rooms and facilities
    • A.7.4 — Physical security monitoring
    • A.7.5 — Protecting against physical and environmental threats
    • A.7.6 — Working in secure areas
    • A.7.7 — Clear desk and clear screen
    • A.7.8 — Equipment siting and protection
    • A.7.9 — Security of assets off-premises
    • A.7.10 — Storage media
    • A.7.11 — Supporting utilities
    • A.7.12 — Cabling security
    • A.7.14 — Secure disposal or re-use of equipment
    • A.8.1 — User end point devices
    • A.8.2 — Privileged access rights
    • A.8.3 — Information access restriction
    • A.8.4 — Access to source code
    • A.8.5 — Secure authentication
    • A.8.6 — Capacity management
    • A.8.7 — Protection against malware
    • A.8.8 — Management of technical vulnerabilities
    • A.8.9 — Configuration management
    • A.8.10 — Information deletion
    • A.8.12 — Data leakage prevention
    • A.8.13 — Information backup
    • A.8.14 — Redundancy of information processing facilities
    • A.8.15 — Logging
    • A.8.16 — Monitoring activities
    • A.8.17 — Clock synchronization
    • A.8.19 — Installation of software on operational systems
    • A.8.20 — Networks security
    • A.8.21 — Security of network services
    • A.8.22 — Segregation of networks
    • A.8.23 — Web filtering
    • A.8.24 — Use of cryptography
    • A.8.25 — Secure development life cycle
    • A.8.26 — Application security requirements
    • A.8.27 — Secure system architecture and engineering principles
    • A.8.28 — Secure coding
    • A.8.29 — Security testing in development and acceptance
    • A.8.31 — Separation of development, test and production environments
    • A.8.32 — Change management
    • A.8.33 — Test information
    • CIR 2024/2690 Annex 1 — Security policy and responsibilities
    • CIR 2024/2690 Annex 2 — Risk management, compliance monitoring and independent review
    • CIR 2024/2690 Annex 3 — Incident handling, monitoring and logging
    • CIR 2024/2690 Annex 4 — Continuity plan, backups and crisis management
    • CIR 2024/2690 Annex 5 — Supply chain policy and supplier register
    • CIR 2024/2690 Annex 6 — Secure acquisition, development and maintenance
    • CIR 2024/2690 Annex 7 — Measuring the effectiveness of security measures
    • CIR 2024/2690 Annex 8 — Awareness and security training
    • CIR 2024/2690 Annex 9 — Cryptography policy and key management
    • CIR 2024/2690 Annex 10 — Personnel security
    • CIR 2024/2690 Annex 11 — Access rights, privileged accounts and authentication
    • CIR 2024/2690 Annex 12 — Asset classification, handling and inventory
    • CIR 2024/2690 Annex 13 — Utilities, environmental threats and physical access
    • Cyberbeveiligingswet art. 21 — Duty of care (Mandatory)
    • Cyberbeveiligingsbesluit art. 6 — Security policy and responsibilities
    • Cyberbeveiligingsbesluit art. 7 — Risk management policy
    • Cyberbeveiligingsbesluit art. 8 — Incident handling and logging
    • Cyberbeveiligingsbesluit art. 9 — Business continuity and crisis management
    • Cyberbeveiligingsbesluit art. 10 — Supply chain security
    • Cyberbeveiligingsbesluit art. 11 — Secure acquisition, development and maintenance
    • Cyberbeveiligingsbesluit art. 12 — Cyber hygiene and training
    • Cyberbeveiligingsbesluit art. 13 — Cryptography policy
    • Cyberbeveiligingsbesluit art. 15 — Access policy
    • Cyberbeveiligingsbesluit art. 16 — Asset management
    • Cyberbeveiligingswet art. 24 — Board approval and training (Mandatory)
    • Cyberbeveiligingswet art. 25 — Duty to report significant incidents (Mandatory)
    • Cyberbeveiligingswet art. 26 — Early warning within 24 hours (Mandatory)
    • Cyberbeveiligingswet art. 27 — Notification within 72 hours (Mandatory)
    • Cyberbeveiligingswet art. 28 — Interim report (Mandatory)
    • Cyberbeveiligingswet art. 29 — Progress report and final report (Mandatory)
    • Cyberbeveiligingswet art. 30 — Informing the recipients of your services (Mandatory)
    • Cyberbeveiligingswet art. 44 — Registration in the national register (Mandatory)

    Nothing found that matches the search criteria.
    Linked requirements show this document as a coverage source on each requirement's Details page.
    Implements policies
    • POL-002 — Acceptable Use Policy
    • POL-003 — Access Control Policy
    • POL-006 — Business Continuity and Disaster Recovery Policy
    • POL-010 — Cryptography Policy
    • POL-013 — Human Resources Security Policy
    • POL-005 — Incident Response Policy
    • POL-009 — Information Classification and Retention Policy
    • POL-001 — Information Security Policy
    • POL-008 — Personal Data Protection Policy
    • POL-012 — Physical and Environmental Security Policy
    • POL-014 — Remote Working and Mobile Devices Policy
    • POL-004 — Risk Management Policy
    • POL-011 — Secure Development and Change Policy
    • POL-007 — Supplier Security Policy

    Nothing found that matches the search criteria.
    Comments on this Procedure (0)

    Add comment

      Are you sure?

      This action cannot be reverted.

      Leave this page?

      Your changes on this form are not saved. If you leave, they are lost.