Scope

This procedure applies in the event of a personal data breach. This procedure lays down the necessary steps companies must do to comply with the General Data Protection Regulation (hereinafter GDPR). 

The company is a data controller/processor.

This notification procedure is intended for internal use only.

Responsibility

All employees/staff, contractors or temporary employees/staff, third party users and shareholders of Gallicantus Ltd are required to be aware of, and to follow this procedure in the event of a personal data breach.

All employees/staff, contractors or temporary personnel are responsible for reporting any personal data breach to the Data Protection Office and Chief Technical Officer.

All breach notifications, evaluations and assessments have to be documented.

Procedure   Breach notification from data processor to data controller

Data processor Gallicantus Ltd reports any and all data breach or security incidents to the data controller without undue delay, but not later than 48 hours. The data processor Galicantus Ltd shall provide the controller with all of the details of the breach.

1. describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
2. communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;
3. describe the likely consequences of the personal data breach;
4. describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects

Procedure – Breach notification data controller to supervisory authority

Gallicantus Ltd determines, if the supervisory authority needs to be notified in the event of a breach. For the determination, the Gallicantus Ltd shall evaluate the effect, the breach has on the data subjects and on the security systems of the company.

If a risk to data subject(s) is likely Gallicantus Ltd  reports the personal data breach to the supervisory authority without undue delay, and not later than 72 hours.

If it is not possible to provide all of the necessary information at the time, Gallicantus Ltd will provide the information in phases without further delay. The following information needs to be sent to the supervisory authority:

1. 1. describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
2. 2. communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;
3. 3. describe the likely consequences of the personal data breach;
4. 4. describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects

The Data Protection Officer / Chief Technical Officer notifies the supervisory authority of the data breach and all the information required in this procedure.

Procedure – Breach notification data controller to data subject

If the personal data breach is likely to result in a high risk to the rights and freedoms of the data subject, Gallicantus Ltd notifies those data subjects affected as soon as possible, but not later than 72 hours. 

The notification to the data subject describes the breach in a clear and plain language and consists of the information provided in the section above.

If the breach affects a high volume of data subjects,Gallicantus Ltd has to make a decision based on the assessment of the amount of effort involved in notifying all data subjects individually and whether the Gallicantus Ltd would manage to inform all the data subjects in the given timeframe. If the assessment indicates, that, the Gallicantus Ltdwould not have enough time to notify all affected data subjects, the Gallicantus Ltd has to make a public notification or similar measure, to inform all affected data subjects in an equally effective manner.