Information, data and records policies · 05
Security compromise and data breach response procedure
The operational procedure for the day personal information is exposed.
The operational procedure for the day personal information is exposed.
Define what counts as a security compromise and how it is reported internally; the containment steps and who takes them; the assessment of risk to data subjects; the notification to the Information Regulator and to affected data subjects, with templates drafted in advance; the record of the incident; and the post-incident review.
POPIA requires notification as soon as reasonably possible after discovery, and the recent enforcement pattern is that reporting an incident invites an assessment of the processing behind it, so the procedure must assume that the Regulator will look past the incident. Draft the notification templates now, in calm conditions; nobody drafts well on the day.
The law it sits under
What governs this instrument.
Section 22 of POPIA requires notification to the Information Regulator and to the affected data subjects where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person. The notification must be in one of the prescribed forms and must contain enough information for the data subject to take protective measures. The cost of that exercise, on a database of any size, is the largest single cost of an incident.
Related pages, tools and documents
Where this instrument sits in the wider set, and the engagement that produces it.
Start here
Tell us the decision your organisation needs to make.
The first conversation is thirty minutes, confidential and free. You will leave it knowing which of our services you need and which you do not.