Data Breach Policy

What will we do in the event of a data breach?

Enquiry Tracker has a Critical Incident Response process (which includes our Developers, and Senior Management), and a Breach Response Plan.

Below is a high level summary of the steps Enquiry Tracker will take in the event of a suspected data breach.

Step 1 – Incident detection and preliminary assessment

• Enquiry Tracker users, employees and contractors can report suspected operational and security breaches to Enquiry Tracker Support via email or phone.
• Enquiry Tracker will take immediate steps to conduct a preliminary investigation, where we will identify and classify the suspected breach.

Step 2 – Contain breach

If the preliminary investigation confirms a suspected breach, we will take immediate steps to:

• Contain the breach.
• Limit distribution of the affected personal information.
• Limit possible compromise of other information.

Step 3 – Evaluate risks associated with the breach

The next step is to undertake a reasonable and expeditious assessment to:

• Gather all relevant information on the breach.
• Determine who needs to be made aware of the breach.
• Document everything at each step.

Step 4 – Notification

Enquiry Tracker will notify affected organisations and users as soon as possible once the facts are known, if:

• There is a chance of serious harm, or if a notification would give the users or customer organisation the ability to avoid serious harm.

Step 5 – Review to prevent future breaches

In the event of a breach, Enquiry Tracker will:

• Fully investigate the cause of the breach.
• Record an incident report.
• Implement recommendations from the investigation to prevent future breaches.