Data breach notification protocol

Considerations

  • Dena Textile Productions B.V. attaches importance to the proper security of its (electronic) systems in which personal data is stored and processed.
  • It can never be fully prevented that a data breach will occur.
  • Dena Textile Productions B.V. is obliged under the General Data Protection Regulation (GDPR) to report (serious) data breaches to the Dutch Data Protection Authority and to the data subjects.
  • Dena Textile Productions B.V. wishes to comply with its legal obligations.
  • Dena Textile Productions B.V. has therefore formulated a policy to act as adequately as possible if, despite all precautions, a data breach occurs.

1. Definition of data breach

A data breach occurs when a security breach accidentally or unlawfully leads to the destruction, loss, alteration, or unauthorized disclosure of, or unauthorized access to, transmitted, stored, or otherwise processed data.

2. Internal responsible for reporting data breaches

Dena Textile Productions B.V. has appointed an internal responsible for the processing of data breaches, who is responsible for reporting a data breach. This responsible is the Marketing department, with the first point of contact being: Rolf van Eden, telephone number +31 (0)318 588 596, email address sales@cheffix.eu, hereinafter referred to as the internal responsible.

3. Internal reporting upon discovery of a data breach

Anyone who discovers a data breach at Dena Textile Productions B.V. immediately reports it to the internal responsible. If possible, the person who discovered the data breach simultaneously ensures that the leaked data is immediately erased remotely or made inaccessible.

4. Investigation by the internal responsible

The internal responsible investigates, among other things:

  • whether personal data has been lost or can be used unlawfully;
  • who or which departments within the organization are involved in the data breach;
  • whether a processor is involved in the incident.

5. Combating data breach

The internal responsible stops the data breach if still possible and then takes the necessary measures to combat the data breach as effectively as possible.

6. Determining the consequences of a data breach

The internal responsible investigates the possible consequences of the data breach based on the nature and extent of the leaked data and determines what the adverse consequences for the data subjects may be.

7. Cooperation in providing data regarding the data breach

The discoverer/reporter of the data breach offers full cooperation to the internal responsible by answering the following questions as quickly and thoroughly as possible (in writing):

  • what happened? (description of the incident)
  • was it accidental or caused by malicious intent (e.g., hacked data)?
  • when did it happen? (date and time)
  • when was it discovered?
  • what type of data (registers) was leaked?
  • are the data encrypted, and if so, how?
  • could the data be remotely erased or made inaccessible, and if so, has that happened?
  • what are the possible consequences for the data subjects?
  • which group(s) of persons is/are affected?
  • how many persons are (approximately) affected?
  • are data of persons in other EU countries also affected by the data breach?
  • could technical and/or organizational measures already be taken as a result of the incident?

8. Availability of staff after discovery of data breach

The head of the department from which the data breach originated, as well as the discoverer of the data breach and anyone who, by virtue of their position or knowledge, is able to take organizational and/or technical measures to limit the consequences of the data breach, must remain available for consultation with the internal responsible or any experts appointed by him, and for carrying out necessary tasks as a result of the data breach, for the first 24 hours after the data breach is discovered.

9. Decision on reporting data breaches

The internal responsible decides as soon as possible, but in any case within 60 hours after discovery of the data breach, whether or not in consultation with the head of the department from which the data breach was discovered and/or experts appointed by him, whether the data breach should be reported to the Dutch Data Protection Authority and/or the data subjects. A data breach is in principle always reported to the Dutch Data Protection Authority, unless it is unlikely that the data breach poses a risk to the rights and freedoms of the data subjects. The report of the data breach is accompanied by answers to the questions as described in section 7. A data breach reported to the Dutch Data Protection Authority will also be reported to the data subjects if it poses a high risk to the rights and freedoms of natural persons, unless appropriate measures have since been taken to mitigate the high risk.

10. Reporting data breaches to the Dutch Data Protection Authority and/or data subjects

The internal responsible, if necessary, takes care of reporting to the Dutch Data Protection Authority and/or the data subject(s). Reporting takes place as soon as possible after discovery and no later than within 60 hours after discovery of the data breach. No other employee than the internal responsible is allowed to report the (possible) data breach themselves to the Dutch Data Protection Authority and/or the data subject(s). If an employee disagrees with the internal responsible's decision regarding whether or not to report the data breach to the Dutch Data Protection Authority and/or the data subject(s), they can express their grievances to the management. If requested, an employee will provide all cooperation to the responsible person to inform the affected persons about the data breach in accordance with Article 34 GDPR.

11. Consequences of reporting data breaches

If the data breach has negative consequences for data subjects, the internal responsible will do everything possible to limit these consequences as much as possible. Depending on the nature and extent of the data breach for data subjects, the internal responsible determines:

  • how data subjects are informed (which will in any case include the types of personal data affected, the possible consequences, what measures Dena Textile Productions B.V. is taking, and how data subjects themselves can prevent or limit the damage);
  • what aftercare data subjects receive;
  • what actions are necessary in the interest of the organization.

If a data breach has occurred, regardless of whether it has been reported or not, adequate technical and/or organizational measures will be taken as soon as possible to prevent similar future data breaches.

12. Keeping a data breach register

The internal responsible maintains a register of all data breaches, in which all data concerning the data breach is recorded, such as:

  • A description of the incident.
  • Date and time of the data breach.
  • Date and time of discovery of the data breach.
  • Description of the type of leaked personal data.
  • Description of the category(ies) of data subjects affected.
  • Approximate number of data subjects affected.
  • Whether data of persons in other EU countries has been leaked.
  • Whether the incident has been reported to the Dutch Data Protection Authority, and if so, date and time of reporting.
  • Whether the incident has been reported to the data subjects, and if so, date and time of reporting.
  • How data subjects were informed.
  • The consequences of the data breach, with date and time if possible.
  • What technical and/or organizational measures have been taken after the data breach, with date and time.

This data breach reporting protocol was drawn up on May 1, 2020.