Data Breach Policy
This policy outlines how Oasco responds to data security incidents, in compliance with GDPR Article 33/34 and UK Data Protection Act 2018.
Detection & Assessment
Upon discovering a potential data breach, our security team will immediately assess the nature, scope, and likely consequences of the incident within 24 hours of discovery.
Notification to Authorities
If a breach is likely to result in risk to individuals' rights and freedoms, we will notify the relevant supervisory authority (ICO in the UK) within 72 hours of becoming aware, as required by GDPR Article 33. Notifications will include: nature of breach, categories and approximate number of data subjects affected, likely consequences, and measures taken to address the breach.
Notification to Affected Users
If a breach is likely to result in a high risk to individuals, we will notify affected users without undue delay via email and in-app notification. The notification will describe the breach clearly, include contact details of our data protection contact, and advise what steps users can take to protect themselves.
Containment & Recovery
Our team will immediately take steps to contain the breach, recover data where possible, patch vulnerabilities, and prevent recurrence. A full incident report will be prepared within 30 days.
Documentation
All data breaches (whether reported to authorities or not) are documented internally, including facts, effects, and remedial actions taken. This record is maintained for a minimum of 3 years.
Contact
To report a suspected data breach or security vulnerability: COMPLIANCE@oasco.net