Personal Data Breach Procedure

This document describes how the operator of the Attendees attendance system, Ing. Matěj Kmínek, Company ID 02877961, proceeds when a personal data breach occurs, that is, accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Art. 4(12) GDPR). The procedure implements Articles 33 and 34 of the General Data Protection Regulation (GDPR) and clause 4.7 of the Data Processing Agreement.

1. Detection#

The operator may be alerted to a possible personal data breach by:

• an application error report or an unusual entry in the server access logs,
• a notice from the hosting provider or from Cloudflare,
• a customer, a user of the system or anyone else who writes to [email protected] or calls +420 721 351 040,
• the operator's own checks, for example an unexplained change to data or files.

The operator enters every suspicion in the incident register together with the time at which it became aware of it. The time limits set out below run from that moment.

2. Containment#

The operator takes measures without delay to stop any further leak or damage, for example:

• blocks the affected system, account or access key,
• changes the passwords and keys to the databases and the server,
• deploys a security fix,
• restores damaged data from a backup,
• secures the records needed for the investigation.

3. Assessment#

The operator assesses:

• which systems and which customers are affected,
• which categories of data and approximately how many data subjects and records are concerned,
• whether it is a breach of confidentiality (a leak), integrity (alteration) or availability (loss, unavailability),
• the likelihood and severity of the risk to the rights and freedoms of the persons concerned, for example whether passwords (stored only as argon2id hashes), contact details or attendance and absence data were leaked.

4. Notifying customers (the operator as processor)#

For the data in the attendance systems, the customer is the controller. The operator notifies the customer of the breach without undue delay after becoming aware of it, by e-mail to the address of the system administrator and, in urgent cases, also by telephone. The aim is to notify the breach within 24 hours at the latest, so that the customer can meet its own 72-hour time limit towards the supervisory authority.

The notification contains:

• a description of the nature of the breach, the categories of data concerned and the approximate number of data subjects and records,
• the likely consequences,
• the measures taken and proposed,
• the operator's contact details for further information.

If not all the information is yet available, the operator provides it in phases. The customer decides whether to notify the breach to the Office for Personal Data Protection (ÚOOÚ) and whether to inform its employees; the operator provides it with the necessary supporting information.

5. Notifying the supervisory authority (the operator as controller)#

For data of which the operator is the controller (the website, installation requests, invoicing), the operator notifies the breach to the Office for Personal Data Protection (ÚOOÚ) (Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz) within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. A notification made after this time limit must state the reasons for the delay.

If the breach is likely to result in a high risk, the operator also informs the persons concerned without undue delay, in clear and plain language, with a recommendation of what they can do to protect themselves (Article 34 GDPR).

6. Documentation#

The operator documents every personal data breach, including one that is not notified: the facts relating to it, its effects, the measures taken and the reasons why it was or was not notified. It keeps the documentation for at least 5 years and presents it to the supervisory authority or to the customer concerned on request.

7. Lessons learned#

After closing the incident, the operator evaluates its cause and adjusts the technical and organisational measures so that it does not recur. It reflects significant changes in the Technical and Organisational Measures document.

Contact#

Report a suspected personal data breach immediately to [email protected] or by telephone on +420 721 351 040. State which system is concerned, what you have found and how we can contact you.