Data Breach Notification
Standard Operating Procedure — Summary
Effective Date: 26 February 2026
Version: 1.0
Compliance: Personal Data Protection Act 2010 (Amendment Act 2024)
1. Purpose
This document summarises YBServe's Standard Operating Procedure for handling Personal Data Breaches in compliance with the Personal Data Protection (Amendment) Act 2024. The Amendment Act 2024 introduces mandatory breach notification requirements for both Data Controllers and Data Processors.
2. Scope
This SOP applies to all Personal Data Breaches involving data processed through the YBServe platform, including breaches affecting:
- Citizen data (constituents who submit issues);
- Authorised User data (staff members);
- Customer data (elected representatives' offices);
- Data held by sub-processors (Supabase, Vercel, OpenAI, Anthropic, Resend, Sentry).
3. Definition of Personal Data Breach
A Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed, as defined under the Amendment Act 2024.
4. Breach Response Timeline
| Phase | Timeline | Actions |
|---|---|---|
| Detection | Immediate | Identify and confirm the breach. Activate incident response team. |
| Containment | Within 4 hours | Isolate affected systems. Prevent further data loss. Preserve evidence. |
| Assessment | Within 24 hours | Determine scope, affected data subjects, and risk of harm. |
| Notification | Within 72 hours | Notify affected Customers and the Commissioner (if required). |
| Remediation | Ongoing | Implement fixes. Conduct root cause analysis. Update procedures. |
5. Notification Obligations
5.1 To the Commissioner
Where a breach is likely to cause significant harm to data subjects, YBServe will notify the Personal Data Protection Commissioner within 72 hours of becoming aware of the breach, providing:
- Nature and scope of the breach;
- Categories and approximate number of data subjects affected;
- Likely consequences of the breach;
- Measures taken or proposed to address the breach.
5.2 To Affected Customers (Data Controllers)
YBServe will notify affected Customers within 72 hours of becoming aware of any breach that affects their data. The notification will include:
- Description of the nature of the breach;
- Data categories and approximate number of records affected;
- Likely consequences;
- Measures taken to contain and remediate the breach;
- Recommended actions for the Customer.
5.3 To Data Subjects
As Data Processor, YBServe will assist Customers (Data Controllers) in notifying affected data subjects where the breach is likely to result in a high risk to their rights and freedoms. The Customer retains responsibility for direct notification to their Citizens.
6. Severity Classification
| Severity | Description | Examples |
|---|---|---|
| Critical | Large-scale data exposure or system compromise | Database breach, authentication bypass, mass data exfiltration |
| High | Significant data exposure affecting multiple tenants | Cross-tenant data leak, unauthorised admin access |
| Medium | Limited data exposure within a single tenant | Unauthorised access to individual records, email misdirection |
| Low | Minimal or no actual data exposure | Failed attack attempt, vulnerability discovered before exploitation |
7. Record-Keeping
YBServe maintains a register of all Personal Data Breaches, including:
- Date and time of the breach;
- Date and time of detection;
- Nature and scope of the breach;
- Categories and number of data subjects affected;
- Containment and remediation measures taken;
- Notifications issued (to Commissioner, Customers, and data subjects);
- Root cause analysis findings;
- Preventive measures implemented.
These records are retained for a minimum of 7 years and are available to the Personal Data Protection Commissioner upon request.
8. Reporting a Suspected Breach
If you suspect a Personal Data Breach involving data processed through the YBServe platform, please report it immediately:
Security Incident Reporting
Email: security@ybserve.com
For urgent security matters, contact us immediately. All reports are treated as confidential.
— END OF DATA BREACH NOTIFICATION SOP SUMMARY —