Data Breach Response Policy
1. Definition of Data Breach
Any unauthorized:
- Access
- Disclosure
- Loss
- Alteration of personal data
2. Response Timeline
1
Step 1: Identification
Within 24 hours
- Detect and confirm breach
2
Step 2: Containment
Immediately
- Secure systems
- Limit exposure
3
Step 3: Assessment
Within 48 hours
- Determine scope and impact
4
Step 4: Notification
Within 72 hours
- Notify:
- Affected users
- Clients
- Regulators (if required)
- Relevant authorities may include:
- National Privacy Commission
- Information Commissioner's Office
3. Communication Plan
Notify affected individuals with:
- Nature of breach
- Data affected
- Steps taken
- Recommended actions
4. Prevention Measures
After resolution:
- Conduct internal review
- Strengthen security systems
- Retrain staff and VAs
5. Documentation
Maintain breach records including:
- Timeline
- Impact
- Actions taken