LD Consultores

Data Security

DATA SECURITY BREACH & INCIDENT MANAGEMENT PROCEDURE

Entity: LD Consultores C.A.

Scope: All employees, contractors, and third-party partners.

Compliance Goal: UK GDPR Article 33, Venezuelan Constitution Art. 28, and ISO 27001:2026.

1. Detection and Initial Reporting

A breach can be a lost laptop, a phishing email, or an accidental CC on a sensitive payroll email.

  • Immediate Action: Any employee who discovers or suspects a breach must report it to the Compliance Officer or Managing Partners immediately.
  • Internal Log: Every report (even if it turns out to be a “near miss”) must be recorded in the Internal Incident Register.

2. The Four-Step Response Plan

Phase 1: Containment and Recovery

  • Goal: Stop the “bleeding” and recover data.
  • Actions: * Shut down compromised servers or accounts.
    • Remote-wipe lost mobile devices.
    • Change all administrative passwords.
    • Attempt to recover data from encrypted cloud backups.

Phase 2: Assessment of Risk

  • Goal: Determine how “bad” the situation is.
  • Criteria:
    • Data Type: Is it “basic” (names) or “sensitive” (medical records/bank details)?
    • Volume: How many people are affected?
    • Risk: Is there a risk of identity theft, financial loss, or damage to reputation?

Phase 3: Notification (The 72-Hour Rule)

  • To the Regulator (UK/International): If the breach involves a risk to individuals’ rights, you must notify the Information Commissioner’s Office (ICO) within 72 hours.
  • To the Client (e.g., NES): You must notify your business partners immediately as per your contractual Data Protection Agreement (DPA).
  • To the Individual: If there is a “high risk” to the person (e.g., their bank details were leaked), you must tell them directly so they can protect themselves.

Phase 4: Evaluation and Response

  • Goal: Make sure it never happens again.
  • Actions: * Conduct a “Post-Mortem” meeting to find the root cause.
    • Update security software or firewall settings.
    • Provide mandatory “Refresher Training” for the staff involved.

3. Breach Notification Template (Internal Use)

When a breach is reported, the Compliance Officer must fill out the following:

  • Date/Time of Discovery:
  • Nature of Incident: (Theft, Hacking, Human Error)
  • Data Categories Involved: (Payroll, Passport copies, Health data)
  • Number of People Affected:
  • Actions Taken to Contain:
  • Reported to ICO? (Yes/No – include reasoning if No)

4. Summary of Responsibilities

RoleResponsibility
All StaffRecognize and report a breach within 1 hour of discovery.
IT/Technical TeamContain the breach and secure the network infrastructure.
Compliance OfficerAssess risk, maintain the log, and notify the Regulator/Client.
Managing PartnersAuthorize emergency resources and oversee the legal response.