The definition of a personal data breach is broad but encompasses all kinds of security incidents that impact personal data. If data is lost, disclosed, changed or destroyed, then there was a breach. In the case of a data breach, Nubian Group (Pty) Ltd will notify the Information Regulator for the PAIA and POPI Act, as well as any parties whose personal information have been accessed or acquired by an unauthorised party. The notification will, at the very least, contain the following information:

• A description of the personal information that was accessed or required;
• A description of the possible consequences of the security compromise;
• A description of the measures taken or proposed to be taken by Nubian Group (Pty) Ltd to remedy the security breach;
• A recommendation of the measures that any party whose personal information was leaked in the security compromise should take in order to mitigate the possible adverse effects of the security compromise;
• The identity of the unauthorised person, if known, who accessed or acquired the personal information.

  In addition to the above procedure, Nubian Group (Pty) Ltd will also respond with the data breach and response plan:

1. Confirm the data breach.
2. Contain the breach.
3. Assess the risks and impact.
4. Report the incident.
5. Evaluate the response.

 
DATA BREACH POLICY: 

1. Confirm the Breach: Nubian Group (Pty) Ltd should act as soon as a data breach has been discovered. Where possible, the data breach should first be confirmed, but depending on the severity of the risk, an official confirmation may not be necessary,
2. Contain the Breach: The following steps should be taken where applicable to contain the breach:
   • Shut down the jeopardised system.
   • Determine if the compromised data can be recovered and if any steps can be taken to limit the damage.
   • Stop any further unauthorised access to the system.
   • Reset passwords if they have been compromised.
   • Isolate the cause of the data breach, and if applicable, change the access rights and external connections to the jeopardised system.
3. Assess the Risks & Impact: Nubian Group (Pty) Ltd should assess the risks and impact on individuals, customers and organisations to better notify the affected parties.
4. Report the Breach: Nubian Group (Pty) Ltd should report the data breach to the Information Regulator as soon as the breach has been contained. The parties who have been affected by the data breach should then be informed of the data breach. Parties should be notified of the breach within five business days. The notification will contain all the information as set out in the POPI Act, as well any preventative measures that can be implemented by the affected parties.
5. Evaluate the Breach: After all steps have been taken to resolve the data breach, Nubian Group (Pty) Ltd should review the cause of the data breach and evaluate the security measures. New practices and measures should be put in place where applicable.