Incident response plan

Any loss of control over personal data: an account used by someone it does not belong to, data reaching the wrong house, a record destroyed or altered without authority, a sub-processor telling us of a breach at their end, or an unexplained gap in the access log.

Suspicion is enough to start this plan. Nobody is ever criticised for raising one that turns out to be nothing.

Anyone — a house, a client, a member of staff — reports it to privacy@ateliersuite.space, marked urgent. A house may also open an entry on its own compliance desk, which timestamps the discovery.

The clock for the 72-hour duty starts when we become aware, so the discovery time is written down before anything else is done.

Name one person to own the incident. Revoke the sessions, keys or invitations involved. Take a copy of the relevant logs before anything is changed, so the evidence survives the fix.

Do not delete anything to tidy up. Containment is separate from repair.

Establish what data, whose data and how much; whether it was read, copied, altered or lost; and what harm could follow — for measurements and addresses, the realistic harm is identification and nuisance rather than financial loss, and that judgement is recorded either way.

Where a house's data is involved we tell that house within 24 hours of becoming aware, with what we know, what we do not yet know, and what we are doing. The house is the controller and makes the decision on reporting.

Unless the breach is unlikely to result in a risk to people, the controller reports it to the Information Commissioner's Office within 72 hours of awareness — ico.org.uk or 0303 123 1113. We provide the facts, the timeline and the technical detail the report needs.

Where the risk to people is high, those people are told directly and in plain language, with what happened, what it means for them, and what to do.

A late report is still made, with the reason for the delay stated.

Every incident is written into the register on the house's compliance desk with the discovery time, what was involved, who was told and when, and the remedy.

Within two weeks we review what allowed it, change the software or the practice, and record the change. The register is kept whether or not the incident was reportable — that record is itself part of the accountability duty.