Data Breach Response Policy

1. Purpose

To explain what we do when personal data is obtained, altered or lost by unauthorised persons, and whom we inform and when.

2. Scope

All personal data processed on the hangel platform and in the Association's systems; breaches at service providers processing data on the Association's behalf.

3. Principles

1. The clock starts when we learn of it. In line with Article 12(5) of the KVKK and Decision 2019/10 of the Personal Data Protection Board, a breach is reported to the Board within 72 hours at the latest from the moment it is discovered; affected people are notified as soon as reasonably possible. For people in the EU, GDPR Articles 33 and 34 are taken into account.
2. Stop the leak first. The first step is closing the source (fixing a rule, rotating a key, cutting access).
3. Sensitive data first. For breaches involving health data (blood group, health consent) or organisations' bank details, the threshold for notification is kept low.
4. Recording. Every breach is recorded, even if no notification is required.

4. Roles and responsibilities

• Person who discovers it: immediately informs kvkk@hangel.org and the technical lead.
• Technical lead: stops the leak, finds the root cause and preserves evidence.
• Data protection contact: opens a record and prepares the notifications to the Board and to individuals.
• Board of Directors: approves the notification decision.

5. How it works at hangel today

1. Detection (T0): A suspected breach can come from an unauthorised access alert, a report from a user or researcher, a misconfigured access rule, a notice from a service provider or a leaked key. The 72 hours start from the moment the breach is discovered.
2. Recording: The "Breach Records" in the super-admin panel (Contracts → Legal Desk) capture the date, a summary, the number of people affected, data types and status (under review, reported to authority, closed). The time of discovery, the root cause and notification times are written into the summary.
3. Containment: The source is closed; sessions and keys are renewed where necessary.
4. Assessment and notification: The risk is assessed; the Board is notified using the Data Breach Notification Form; affected people are informed by e-mail and in-app notification.
5. Lessons learned: The root cause and the measures taken are added to the record's summary.

These steps are based on the written response document (data breach runbook) in the repository.

6. Not yet in place and our goals

• The response steps have not been tested in an exercise; our goal is one tabletop exercise per year.
• The breach notification deadlines in contracts with service providers have not been checked provider by provider.
• There is no ready-made template for the notice to affected people.
• The breach record has no separate fields or timeline for the time of discovery, the time of the incident, the root cause, the containment time and the times of notification to the Board and to individuals; our goal is to add them and a countdown showing the 72-hour deadline.
• There is no appointed Data Protection Officer (DPO).

7. How to raise a concern

Suspected personal data breach: kvkk@hangel.org. Security vulnerability: info@hangel.org (subject "Security report").

8. Review

At least once a year and after every breach.

9. Related documents

Existing "Data Breach Notification Procedure" · Information Security Policy · Personal Data Protection Policy · Crisis and Business Continuity Policy