Data Breach Management & Reporting Policy

Data Breach & Security Incident Management Policy
NEW LEAF COUNSELLING & INTEGRATIVE HEALTH Pte Ltd (Company Registration No. 202411861C)

Introduction
Safeguarding personal data is paramount at New Leaf Counselling & Integrative Health Pte Ltd. Despite our proactive measures, data breaches and security incidents can still occur. Clear procedures for identifying, managing, and reporting such incidents are therefore essential.

Purpose
This combined policy establishes comprehensive procedures for detecting, managing, reporting, investigating, and responding to data breaches and security incidents. Adherence ensures minimal impact on affected individuals and businesses, while maintaining compliance with applicable data protection laws and regulations.

Scope
This policy applies to all employees, contractors, and third-party vendors who handle personal data, and it encompasses all types of data breaches and security incidents.

Definitions
Data Breach: Unauthorised access, disclosure, alteration, or loss that leads to the compromise of personal data.

Security Incident: Unauthorised access, disclosure, alteration, or destruction that compromises the confidentiality, integrity, or availability of data.

Reporting Procedures
Any employee or contractor who suspects a breach or incident must report it immediately to the Data Protection Officer (DPO) or designated individual. Reports should include relevant incident details such as the nature, scope, date, and potential impact. Incidents involving third-party vendors must also be reported to the relevant vendor contacts.

Investigation and Response
Upon receiving a report, the DPO or designated individual initiates an investigation. The investigation assesses severity, gathers evidence, determines causes, and evaluates potential impacts. Based on these findings, appropriate response measures are coordinated, including notifications and remedial actions.

Documentation and Reporting
Meticulous documentation and reporting are integral to our data breach management process.

Incident Documentation: All incidents, from initial reports through to investigative findings and response actions, are carefully documented. This ensures transparency and accountability throughout the incident management lifecycle.

Regulatory Reporting: The DPO oversees the submission of any necessary notifications or reports to regulatory authorities or data protection agencies. These submissions adhere to regulatory requirements and timelines, maintaining compliance and fostering trust with regulatory bodies.

Communication and Notification
Effective communication and timely notification are fundamental to our data breach response strategy.

Prompt Notification: Affected individuals are promptly notified in accordance with applicable laws and regulations. This ensures transparency and empowers individuals to take the necessary protective measures.

Comprehensive Notifications: Our notifications provide clear, comprehensive information about the incident, including its nature, the types of data affected, and recommended protective steps. This transparency enables affected individuals to understand the potential impact and take appropriate action to mitigate risks.

Stakeholder Engagement: We engage relevant stakeholders to coordinate response efforts and manage risks effectively. This collaborative approach ensures a unified response to incidents, minimising disruption and safeguarding our reputation.

Data Breach Management
Our proactive approach to data breach management encompasses comprehensive planning, training, and continuous improvement.

Response Plans: We maintain robust data breach response plans that set out the roles, responsibilities, and actions for managing breaches effectively. These plans are reviewed and updated regularly to reflect evolving threats and best practices.

Training and Simulations: Regular training and simulations ensure our personnel are prepared to respond promptly and effectively. Simulating realistic scenarios enhances readiness and resilience, enabling swift and coordinated responses when incidents occur.

Post-Incident Reviews: Following any incident, we conduct thorough post-incident reviews to identify lessons learned and opportunities for improvement. This continuous learning process enables us to refine our response capabilities and strengthen our overall cybersecurity posture.

Review and Compliance
Regular review and rigorous compliance are fundamental to our commitment to data protection and privacy.

Policy Reviews: We regularly review our policies to ensure alignment with applicable laws, regulations, and best practices. This ongoing process enables us to adapt effectively to evolving regulatory requirements and emerging threats.

Mandatory Compliance: All personnel must comply with our data breach management policies and procedures. Failure to report incidents or adhere to established protocols may result in disciplinary action. This reinforces accountability and underscores the importance of maintaining robust data protection practices throughout our organisation.

Contact Information
For any queries or to report an incident, please contact the Data Protection Officer (DPO) at: dpo@newleaf.com.sg