Data Breach Response Protocol

In line with our commitment to data protection and compliance with the General Data Protection Regulation (GDPR), Sonat has established a comprehensive Data Breach Response Protocol. This protocol outlines our approach to detecting, reporting, and responding to personal data breaches. A personal data breach is a security incident that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

Detection and Reporting

• Detection: Sonat employs advanced security measures and monitoring systems designed to detect data breaches promptly. Our IT and security teams are trained to recognize signs of unauthorized access or other security incidents.
• Immediate Response: Upon detection of a potential data breach, our team initiates an immediate investigation to assess the scope and impact of the incident. The primary goal is to contain the breach and prevent further unauthorized access to or loss of personal data.
• Internal Reporting: All suspected or confirmed data breaches are reported internally to designated Data Protection Officers (DPOs) and senior management within a strict timeframe to ensure rapid response.

Assessment and Notification

• Risk Assessment: Following the containment and initial investigation, a thorough risk assessment is conducted to understand the nature of the data involved, the likelihood and severity of risks to data subjects' rights and freedoms, and to determine the necessity of notifying affected individuals and regulatory bodies.
• Notification to Supervisory Authority: In compliance with GDPR, if the breach poses a risk to the rights and freedoms of individuals, Sonat will notify the relevant supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it.
• Communication to Affected Individuals: When the breach is likely to result in a high risk to the rights and freedoms of individuals, Sonat will communicate the breach directly to the affected data subjects without undue delay. This communication will include clear and specific information about the nature of the breach, the likely consequences, and the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.

Mitigation and Prevention

• Mitigation Measures: Immediate steps will be taken to mitigate the effects of the breach and protect affected data subjects, including but not limited to, password resets, securing data storage and transmission, and providing advice on protective actions to the individuals impacted.
• Prevention of Future Breaches: Sonat is committed to learning from every data breach incident. We conduct detailed post-breach analysis to identify the root causes and implement improved security measures and practices to prevent future occurrences. This may include updating our IT security, enhancing our data protection policies, and further staff training on data security.

Documentation and Record-Keeping

• Breach Documentation: Every data breach, regardless of its size or impact, is documented thoroughly, including the facts surrounding the breach, its effects, and the remedial actions taken. This documentation will be used to inform future prevention strategies and as required by GDPR to demonstrate accountability and compliance in handling data breaches.

Conclusion

Sonat's Data Breach Response Protocol is an integral part of our commitment to safeguarding personal data and ensuring trust and transparency with our customers and partners. We are dedicated to continuous improvement of our data security practices and to responding to data breaches with urgency, care, and compliance with all applicable data protection regulations.