Data Breach Response Policy & Procedures
Policy Statement
Kinetic Wizard is committed to protecting personal data and maintaining the privacy and security of all information entrusted to us by our clients, partners, and stakeholders. This policy establishes our comprehensive approach to preventing, detecting, responding to, and reporting personal data breaches in compliance with applicable data protection laws including the Australian Privacy Act 1988, GDPR, and other relevant jurisdictions.
2. Scope and Application
This policy applies to:
All personal data processed by Kinetic Wizard
All employees, contractors, and third-party service providers
All systems, applications, and infrastructure containing personal data
Data processed on behalf of clients
3. Data Breach Response Contact Information
Emergency Breach Hotline: +61 421504199
Secure Email: info@kineticwizard.com
4. Breach Detection and Assessment
4.1 Detection Methods
Automated security monitoring systems
Employee reporting mechanisms
Third-party security notifications
Client or partner notifications
Regular security audits and assessments
4.2 Initial Assessment (Within 1 Hour)
Upon detection, the following immediate assessment must occur:
Verify the incident - Confirm a breach has occurred
Assess scope - Determine types and volume of data affected
Identify cause - Understand how the breach occurred
Evaluate ongoing risk - Assess if breach is contained or ongoing
Activate response team - Notify appropriate team members
5. Breach Response Procedures
5.1 Immediate Response (0-24 Hours)
Step 1: Containment and Preservation
Isolate affected systems to prevent further unauthorized access
Preserve evidence for investigation
Document all actions taken with timestamps
Secure backup systems and alternative data sources
Step 2: Impact Assessment
Identify all affected individuals and data categories
Assess potential harm to affected parties
Evaluate business impact and operational disruption
Determine if ongoing monitoring is required
Step 3: Initial Notifications
Notify senior management within 2 hours
Inform relevant business partners
Consider law enforcement notification if criminal activity suspected
5.2 Investigation Phase (24-72 Hours)
Detailed Investigation
Conduct comprehensive forensic analysis
Interview relevant personnel
Review system logs and access records
Engage external cybersecurity experts if required
Document all findings and evidence
Root Cause Analysis
Identify technical vulnerabilities exploited
Assess adequacy of existing security measures
Evaluate human factors contributing to breach
Review compliance with existing policies and procedures
5.3 Regulatory Notification Requirements
Timeline for Notifications
Supervisory Authorities: Within 72 hours of becoming aware (GDPR)
Australian Privacy Commissioner: As soon as practicable, no later than 30 days (Australian Privacy Act)
Other Partners/Clients: As contractually required or within 72 hours
Required Information for Notifications
Nature of the breach and data categories affected
Number of affected individuals (approximate if exact number unknown)
Likely consequences of the breach
Measures taken or proposed to address the breach
Contact details for further information
6. Communication Management
6.1 Internal Communications
Executive briefing within 4 hours
Staff notification as appropriate to roles
Regular status updates to management
Legal and compliance team involvement
6.2 External Communications
Client and Partner Notifications
Affected clients: Within 24-72 hours depending on severity
Business partners: As contractually required
Individual Notifications
When required by law or contract:
Clear, plain language explanation of the breach
Types of personal information involved
Steps being taken to investigate and address the breach
Measures individuals can take to protect themselves
Contact information for questions and support
Media and Public Communications
Coordinate with legal counsel and senior management
Prepare holding statements and fact sheets
Designate authorized spokesperson
Monitor media coverage and social media
7. Documentation and Record Keeping
7.1 Incident Documentation
All breaches must be documented in the Data Breach Register including:
Date and time of breach discovery
Description of the incident and affected data
Number of individuals affected
Assessment of harm and risk
Actions taken to contain and remediate
Notifications made and recipients
Lessons learned and preventive measures
7.2 Evidence Preservation
Maintain forensic images of affected systems
Preserve logs, communications, and investigative materials
Document chain of custody for all evidence
Retain records for minimum 7 years or as required by law
8. Remediation and Recovery
8.1 Technical Remediation
Patch security vulnerabilities identified
Implement additional security controls
Update access controls and authentication systems
Enhance monitoring and detection capabilities
8.2 Process Improvements
Review and update security policies
Conduct additional staff training
Implement recommended controls from investigation
Regular testing of improved procedures
8.3 Support for Affected Individuals
Credit monitoring services (if appropriate)
Identity protection assistance
Dedicated support hotline
Regular updates on investigation progress
9. Testing and Training
9.1 Regular Testing
Annual tabletop exercises simulating breach scenarios
Quarterly review of contact lists and procedures
Semi-annual testing of backup and recovery systems
Regular penetration testing and vulnerability assessments
9.2 Staff Training
Initial training for all new employees
Annual refresher training for all staff
Specialized training for incident response team members
Regular awareness campaigns and updates
10. Third-Party and Vendor Management
10.1 Vendor Breach Notifications
Require immediate notification from all vendors/processors
Maintain updated contact information for all third parties
Regular review of vendor security practices
Contractual requirements for breach response coordination
11. Continuous Improvement
11.1 Post-Incident Review
Comprehensive review within 30 days of incident closure
Assessment of response effectiveness
Identification of improvement opportunities
Update of policies and procedures based on lessons learned
11.2 Regular Policy Review
Annual comprehensive policy review
Quarterly updates to contact information and procedures
Regular benchmarking against industry best practices
Incorporation of new regulatory requirements
12. Compliance and Audit
12.1 Regulatory Compliance
Regular compliance assessments against applicable laws
Engagement with legal counsel for regulatory updates
Maintenance of required certifications and attestations
Cooperation with regulatory investigations
12.2 Audit Requirements
Annual independent security audits
Regular internal compliance reviews
Documentation of all compliance activities
Maintenance of audit trails for all breach-related activities
