Data Breach Procedure

1. Introduction

Aurum Advies, trade name of Private Holding B.V., processes personal data and is responsible for protecting that data. In the event of a breach of the security of personal data (a data breach), it is necessary to act adequately and to comply with the notification obligation laid down in the General Data Protection Regulation (GDPR). This procedure describes how Private Holding B.V. deals with a data breach.

2. Identifying a Data Breach

2.1 Definition

A data breach is a security incident in which personal data has been accidentally or unlawfully destroyed, lost, altered, disclosed without authorisation or made accessible.

2.2 Examples of data breaches

• Loss or theft of a laptop, USB stick or smartphone containing personal data.
• An e-mail containing personal data that was sent to the wrong recipient.
• A hack of a database containing client data.
• Unauthorised access to systems containing personal data.
• Accidentally making sensitive client data public.

3. Reporting Procedure

3.1 Internal reporting

When a (possible) data breach is discovered, it must be reported immediately to the Data Protection Officer (DPO):
Mr G.B. van de Kraats
E-mail: info@aurumadvies.com

3.2 Documentation

The following details are recorded:

• Date and time the data breach was discovered.
• Nature and scope of the breach (which data is involved?).
• Cause and possible consequences.
• Actions taken to limit the damage.

4. Assessing the Data Breach

4.1 Risk analysis

The impact of the data breach is assessed on the basis of the following questions:

• Which personal data has been leaked?
• How sensitive is this data?
• How many people are affected?
• Can the data be misused?

4.2 Decision to notify

Based on the risk analysis, it is determined whether notification to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) and/or the data subjects is required.

5. Notification to the Dutch Data Protection Authority

5.1 Notification obligation

If the data breach poses a risk to the rights and freedoms of data subjects, it must be reported to the AP within 72 hours of discovery.

5.2 Content of the notification

The notification to the AP contains:

• The nature of the data breach and the personal data involved.
• The likely consequences of the data breach.
• The measures taken or proposed to limit the consequences.
• Contact details of the DPO.

6. Informing the Data Subjects

6.1 Duty to communicate

If the data breach is likely to result in a high risk to the rights and freedoms of the data subjects, they must be informed immediately.

6.2 Content of the communication

The data subjects are informed about:

• The nature of the data breach.
• The possible consequences.
• The measures they can take to limit the consequences.

7. Preventive Measures

7.1 Evaluation

After the data breach has been handled, an evaluation determines what the cause was and which measures can be taken to prevent a recurrence.

7.2 Security measures

• Use of strong passwords and two-step verification.
• Regular software updates and security checks.
• Encryption of sensitive data.
• Regular backups.

8. Documentation and Retention

All data breaches are documented, regardless of whether they must be reported. This register contains:

• Description of the incident.
• Assessment of the risks.
• Decision-making on notification.
• Supporting measures.