10.1. Disclaimer
We have taken all reasonable steps to safeguard the privacy of information provided by you, but we do not make any representations or warranties that the information provided by you, whether personal information, or otherwise, is absolutely safe and secure. Should a data breach occur, we will take immediate measures to stop it and minimise its impact.
10.2. What Is A Data Breach?
We consider a data breach to be one or more of the following:
-
• Loss or theft of confidential or sensitive data or equipment on which such data is stored (e.g. loss of laptop, USB stick, iPad / tablet device, or paper record).
-
• Equipment theft or failure.
-
• System failure.
-
• Unauthorised use of; access to or modification of data; or information systems.
-
• Attempts (failed or successful) to gain unauthorised access to information or IT system(s).
-
• Unauthorised disclosure of sensitive / confidential data.
-
• Website defacement.
-
• Hacking attack.
-
• Human error.
-
• ‘Blagging’ offences where information is obtained by deceiving the organisation who holds it.
10.3. Investigation And Containment
If we discover or are notified of any of the above:
We will firstly determine whether the breach is ongoing, and if so, take immediate measures to stop it and minimise its impact.
Secondly, we will investigate the extent and severity of the breach and assess the risks associated with it, for example, the potential adverse consequences for individuals, how serious or substantial those are and how likely they are to occur. This investigation will consider the following:
-
• The type of data involved.
-
• Its sensitivity.
-
• The protections which are in place (e.g. encryptions).
-
• What has happened to the data (e.g. has it been lost or stolen).
-
• Whether the data could be put to any illegal or inappropriate use.
-
• Data subject(s) affected by the breach, number of individuals involved and the potential effects on those data subject(s).
-
• Whether there are wider consequences to the breach.
10.4. Notification
After investigating the breach, we will determine whether it is necessary to report it, and if so, will do so within a maximum of 72 hours of becoming aware of the breach, if possible.
Every incident will be assessed on a case by case basis. The following will be considered:
-
• Whether the breach is likely to result in a high risk of adversely affecting individuals’ rights and freedoms under the Protection of Personal Information Act (“POPIA”).
-
• Whether notification would assist the individual(s) affected (e.g. could they act on the information to mitigate risks?)
-
• Whether notification would help prevent the unauthorised or unlawful use of personal data.
-
• Whether there are any legal / contractual notification requirements.
-
• The dangers of over notifying. Not every incident warrants notification and over notification may cause disproportionate enquiries and work.
Individuals whose personal data has been affected by the incident, and where it has been considered likely to result in a high risk of adversely affecting that individual’s rights and freedoms will be informed without undue delay. Notification will include a description of how and when the breach occurred and the data involved. Specific and clear advice will be given on what they can do to protect themselves, and include what action has already been taken to mitigate the risks. Individuals will also be provided with a way in which they can contact us for further information or to ask questions on what has occurred.
We will consider notifying third parties such as the police, insurers, banks or credit card companies. This would be appropriate where illegal activity is known; or is believed to have occurred; or where there is a risk that illegal activity might occur in the future.
We will consider whether our marketing team should be informed regarding a press release and to be ready to handle any incoming press enquiries.
An internal record will be kept of any personal data breach, regardless of whether notification was required.
10.5. Evaluation And Response
Once the initial incident is contained, we will carry out a full review of the causes of the breach, the effectiveness of the response(s) and whether any changes to systems, policies and procedures should be undertaken.
Existing controls will be reviewed to determine their adequacy, and whether any corrective action should be taken to minimise the risk of similar incidents occurring.
The review will consider:
-
• Where and how personal data is held and where and how it is stored.
-
• Where the biggest risks lie including identifying potential weak points within existing security measures.
-
• Whether methods of transmission are secure; sharing minimum amount of data necessary.
-
• Staff awareness.
If deemed necessary, a report recommending any changes to systems, policies and procedures will be considered by the ASP School Projects board.
