Data Breach Response Procedure

DATA BREACH RESPONSE PROCEDURE

1. Purpose

This Procedure establishes the process KMC will follow if personal information is accidentally or unlawfully:

• accessed;

• disclosed;

• altered;

• lost;

• destroyed;

• made unavailable;

• accessed by an unauthorised person.

2. Examples

A privacy breach may include:

• an email sent to the wrong person;

• unauthorised access to a candidate account;

• stolen equipment;

• compromised passwords;

• malware or ransomware;

• accidental disclosure of candidate information;

• incorrect employer access;

• compromised third-party systems;

• lost files;

• unauthorised database access.

3. Immediate response

Employees or contractors who become aware of a suspected breach must immediately notify:

KMC Privacy Officer / Security Contact:
[CONTACT DETAILS]

The person reporting the incident should provide the information they have available and should not attempt to conceal the incident.

4. Containment

KMC will take reasonable immediate steps to contain the breach.

Depending on the circumstances, this may include:

• disabling accounts;

• resetting passwords;

• removing access;

• isolating affected systems;

• stopping unauthorised sharing;

• retrieving incorrectly sent information;

• securing affected devices;

• contacting relevant technology providers.

5. Assessment

KMC will assess:

• what information was affected;

• how many individuals were affected;

• whether the information was sensitive;

• who may have accessed it;

• whether the information was encrypted;

• whether the information remains accessible;

• the likelihood of harm;

• the seriousness of potential harm.

6. Notifiable privacy breach

Where KMC reasonably believes a privacy breach has caused serious harm or is likely to cause serious harm, KMC will follow the notification requirements under the Privacy Act 2020.

KMC will notify the Office of the Privacy Commissioner and affected individuals where required by law.

7. Timing

KMC will make notifications as soon as practicable after determining that notification is required.

KMC will aim to assess and progress notification promptly and, where practicable, within 72 hours of becoming aware of a potentially notifiable breach.

8. Affected individuals

Where notification is required, KMC will provide appropriate information about:

• what happened;

• what information may have been affected;

• what KMC has done;

• what the individual can do to protect themselves;

• who they can contact for further information.

9. Regulatory notification

KMC will use the Office of the Privacy Commissioner's prescribed notification process where required.

10. Investigation

KMC will investigate the cause of the incident and document:

• date and time;

• systems affected;

• information affected;

• people affected;

• containment measures;

• notification decisions;

• remediation;

• lessons learned.

11. Remediation

KMC may implement:

• additional security controls;

• password resets;

• access changes;

• staff training;

• technical fixes;

• vendor changes;

• policy changes;

• privacy impact assessments.

12. Serious immediate risk

If a breach presents an immediate threat to someone's physical safety or other serious harm, KMC may contact appropriate emergency services or authorities.

13. Review

Every significant breach will be reviewed to identify improvements to KMC's privacy and security controls.