Consultant Login ➜

Data Breach Response & Notification Policy

Introduction & Purpose

Humanics Global Advisors (HGA) is committed to protecting the security and privacy of data on the HGA Digital Platform (formerly DevTender) and all systems, devices, and third-party tools used by our consultants and staff. This Data Breach Response & Notification Policy establishes clear procedures for responding to any actual or suspected data breach. It aligns with HGA’s existing commitments to data protection, confidentiality, security monitoring, and lawful cross-border data processing[1]. In particular, HGA adheres to global best practices (e.g. GDPR, CCPA) for safeguarding personal information and requires prompt notification of any security incident involving personal data[2]. The goal of this Policy is to ensure that if a breach occurs, HGA will identify, contain, investigate, remediate, and recover from the incident effectively, while communicating appropriately with internal teams, affected individuals, authorities, and partners in compliance with applicable laws.

Scope: This Policy applies to the HGA Digital Platform and all information systems, devices, networks, and third-party services used by HGA staff and consultants in the course of work. It covers incidents involving unauthorized access, loss, disclosure, or corruption of sensitive data (including personal data of consultants, clients, or staff, and any confidential business data). All HGA employees, independent consultants, contractors, and service providers must follow this Policy in the event of a security incident or data breach.

Key Objectives:

  • Prompt Identification and Containment: Ensure potential breaches are recognized quickly (via monitoring or reporting) and immediate steps taken to prevent further data loss or damage.
  • Thorough Investigation: Determine the scope, root cause, and impact of the incident, including what data was compromised and which individuals or systems are affected.
  • Effective Remediation: Address vulnerabilities or control failures that led to the breach, eliminate threats (e.g. malware), and take corrective actions to prevent recurrence.
  • Recovery and Continuity: Restore affected systems or data (from clean backups if needed) to resume normal operations with minimal downtime, using HGA’s disaster recovery plans.
  • Clear Communication & Notification: Establish internal escalation paths and external notification protocols so that all stakeholders (leadership, staff, affected individuals, regulators, clients/partners) are informed in a timely and appropriate manner, consistent with legal requirements (e.g. GDPR 72-hour rule, state breach laws)[3][4].
  • Accountability and Improvement: Maintain documentation of incidents and responses, fulfill any regulatory record-keeping obligations, and review each incident to improve our security measures and response processes over time.

By following this Policy, HGA seeks to minimize harm from any data breach, meet its contractual and legal obligations, and uphold the trust placed in us by our consultants, clients, and partners.

Roles and Responsibilities

Effective breach response requires clearly defined roles. HGA will maintain an Incident Response Team (IRT), composed of personnel (by role, not by name) responsible for executing this Policy. Key roles include:

  • Incident Response Lead (IR Lead): Typically the IT System Manager or Security Officer who coordinates the overall response. The IR Lead is responsible for activating the incident response plan, directing team members through identification, containment, investigation, remediation, and recovery steps, and ensuring communication protocols are followed. They implement and monitor security protocols on the platform[5] and address any potential security threats or breaches[6] as part of their oversight duties.
  • Data Protection Officer (DPO) / Compliance Lead: Oversees privacy compliance. Ensures that legal notification obligations (under GDPR, CCPA, etc.) are met and that investigation documentation is properly maintained. The DPO (or equivalent privacy officer) will liaise with regulators as needed and advise on notifying affected individuals in line with data protection laws. (If HGA does not formally have a DPO, a compliance manager or legal counsel will fulfill this role.)
  • IT Security Team / System Administrators: These personnel handle technical containment and investigation. They monitor intrusion detection systems and logs in real-time[7], analyze indicators of compromise, and secure affected infrastructure. They also implement technical fixes (patches, access changes, etc.) during remediation. They ensure that HGA’s security tools (firewalls, anti-malware, etc.) and continuous monitoring systems trigger alerts for suspicious activities[7], and they perform the forensic analysis of impacted systems.
  • Management (Executive Sponsor): A senior manager (e.g. CTO or COO) provides oversight, resources, and decision-making authority. They may be responsible for approving external communications (e.g. breach notifications to clients or public statements) and for reporting major incidents to HGA’s executive leadership or board. Management ensures that the incident response has sufficient support and that any business continuity actions (like activating disaster recovery or backup systems) proceed.
  • Legal Counsel: Assists with understanding and interpreting breach notification laws in various jurisdictions and any contractual obligations to clients/partners. Legal advisors review communications to ensure they appropriately communicate the situation without creating undue liability. They coordinate with law enforcement or external regulators when necessary.
  • Communications Lead: Handles external and internal communications strategy. This could be a PR professional or someone appointed in the IRT. They prepare clear, accurate notifications and updates for affected individuals, clients, partners, media (if needed), and ensure that messages are consistent. They also manage inquiries (e.g. from affected data subjects or press) after a breach is announced.
  • Consultants and Staff: Every HGA consultant or staff member has the responsibility to remain vigilant and immediately report any suspected data breach or security incident. They might be the “first responders” who notice unusual activity, lost devices, or errant emails. Staff and consultants must cooperate fully with the IRT during investigations (for example, by providing information or preserving evidence) and must not disclose or discuss the incident externally unless authorized. They are also expected to uphold confidentiality of sensitive information in general, as required by HGA’s agreements and policies.

Note: In practice, the Incident Response Team may consist of a core group (IR Lead, IT/security, DPO, etc.) and co-opt additional members as needed (e.g. HR if employee data is involved, a cloud service rep if third-party systems are impacted). High-level roles are described above without naming specific individuals; HGA will assign actual personnel to these roles in an up-to-date internal contact list for incident response.

Incident Response Procedure

HGA follows a structured incident response process encompassing five key phases: Identification, Containment, Investigation, Remediation, and Recovery. Each phase is detailed below:

1. Identification and Reporting

Detecting Potential Incidents: HGA’s systems are continuously monitored for signs of security breaches or anomalies[7]. Automated security tools (intrusion detection systems, log monitors, etc.) alert the IT Security Team to unusual activities (e.g. multiple failed logins, unusual data exports)[8]. In addition, all personnel must be alert to potential breach indicators such as lost/stolen equipment, unexpected system behavior, missing or corrupted files, or confidential data appearing in unauthorized places.

Internal Reporting: If any employee or consultant suspects a data breach or observes a security incident, they must immediately report it to the Incident Response Lead (or via the designated incident hotline/email). HGA encourages a “if you see something, say something” culture. Prompt internal reporting is critical so that the IRT can respond quickly. No disciplinary action will result from a good-faith report of a suspected breach.

Initial Assessment: The Incident Response Lead (with IT Security staff) will quickly assess incoming incident reports or alerts to determine if a security event constitutes a potential data breach. A “data breach” in this context means any incident that potentially compromises the confidentiality, integrity, or availability of sensitive information[9] – for example, unauthorized access, disclosure, alteration, or loss of personal data. If uncertainty exists, the team errs on the side of treating the event as a suspected breach until proven otherwise.

If the incident is confirmed (or reasonably suspected) to involve personal data or other confidential data being compromised, the Incident Response Lead will formally declare a Data Breach Incident and activate this response plan. This includes opening an incident log (see Appendix A) and notifying the Incident Response Team members to assemble (virtually or physically) for immediate action.

2. Containment

Once a breach is identified, containment is the first priority to limit its scope and impact. The Incident Response Team will take swift action to prevent further unauthorized access or data leakage:

  • Isolate Affected Systems: Immediately disconnect or shut down compromised servers, devices, or user accounts from the network if needed to halt an ongoing intrusion. For example, if malware is spreading or data exfiltration is in progress, the affected host or application is taken offline. (Caution: Do not power off systems unless necessary; instead, isolate from network to preserve forensic evidence.)
  • Secure Vulnerable Points: Change passwords or revoke credentials that may have been stolen (e.g. if an account was compromised)[10]. Implement temporary firewall rules or access control list updates to block malicious traffic. If an email account is sending phishing messages, disable it. HGA’s multifactor authentication (MFA) requirement for logins provides an extra layer of protection to limit unauthorized access[11], but if credentials are suspected to be exposed, those accounts will be locked and credentials reset.
  • Stop Data Loss: If the breach involves cloud storage or databases, restrict queries or exports. For example, suspend the database or storage bucket that was accessed. If data was posted publicly (e.g. on our website or a code repository), remove it immediately[12] and work with the relevant platform to purge cached copies.
  • Preserve Evidence: While containing the issue, the team takes care to preserve logs, system images, and other evidence of the incident. For instance, before disconnecting a compromised server, a memory dump or disk image might be taken if possible. All containment actions are logged with timestamp and description in the incident report.
  • Temporary Workarounds: If needed (to maintain business continuity), put safe systems online to replace affected ones[10]. For example, if a payroll system is taken down due to breach, switch to a backup system or offline process until it’s secure to restore the original.
  • Engage Third-Party Support: If a third-party service or vendor is involved (e.g. our cloud hosting or a SaaS tool) and they can assist in containment, contact them immediately. For example, notify the cloud provider’s security team to help isolate resources or the vendor of a compromised third-party tool to get their support and information.

Throughout containment, internal communication is key: the IR Lead will keep management and key stakeholders apprised of what’s being done to control the situation. If the incident might have immediate impact on users or clients (for instance, a public website breach), HGA may craft an initial holding statement to reassure that steps are being taken, even before full details are known – but generally, detailed external communications will wait until investigation yields clearer information (unless urgent notification is needed to prevent further harm).

3. Investigation and Analysis

With the immediate threat contained, the Incident Response Team will investigate the incident in depth to understand exactly what happened and what data or systems were impacted. The goals of the investigation are to determine the nature and scope of the breach, identify affected data/individuals, and uncover root causes.

Key Investigation Actions:

  • Forensic Analysis: The IT Security Team (or external forensic experts, if engaged) will analyze system logs, audit trails, alerts, and any preserved evidence from affected systems. All relevant security logs and reports are reviewed[13] – for example, authentication logs, database access logs, API call logs, etc. – to trace the timeline of the incident. They determine how the intruder gained access, what actions were performed, and if any data was exfiltrated or modified. If malware was involved, it is analyzed to understand its capabilities (e.g. did it install a backdoor? capture keystrokes?).
  • Identify Affected Data and Individuals: The team compiles an inventory of what information was compromised. This includes identifying specific databases, files, or records accessed. We categorize the data (e.g. personal data like names, emails, IDs; financial data; client confidential documents; etc.) and estimate the number of individuals or records involved[14]. For personal data breaches, this means determining the categories and number of data subjects affected (approximately) and what types of personal data were exposed[14]. If the breach involves special sensitive data (financial info, health info, etc.), note that as it elevates the severity. This analysis will later inform whom we need to notify (e.g. all affected users) and what we tell them.
  • Impact Assessment: The DPO/Compliance Lead works with the technical team to assess risks to individuals and HGA resulting from the breach. We evaluate the likely consequences of the breach[15]: Could individuals suffer identity theft, financial fraud, privacy harms, reputational harm, or other damage? For example, loss of a customer database with emails and passwords would carry risk of account compromise, whereas a leak of public information would pose minimal harm. This risk assessment is crucial for determining notification obligations – under GDPR, if the breach is unlikely to result in risk to individuals’ rights, it might not require authority notification, but if likely to result in high risk to individuals (e.g. exposure of sensitive personal data), we must inform those individuals without undue delay[16]. We document this risk evaluation thoroughly.
  • Breach Classification: Based on scope and impact, the IR Lead assigns a severity level to the incident (see Appendix B: Data Breach Classification Chart). This classification (Low, Moderate, High, or Critical) helps prioritize response efforts and communication. For instance, a low-severity incident might involve a lost encrypted device with no evidence of misuse, whereas a high-severity breach might involve hackers exfiltrating sensitive personal data like Social Security numbers[17]. This classification also guides whether regulatory or individual notifications are required. (Example: A lost laptop that was encrypted would be classified as Low severity and likely not notifiable under many laws, while theft of a database of client personal data would be High or Critical severity, requiring broad notification).
  • Root Cause Determination: The team identifies how and why the breach occurred. Was it due to a misconfiguration, a software vulnerability, credential theft (phishing), insider wrongdoing, or procedural failure? For example, investigation might reveal that an outdated software patch allowed an exploit, or that an employee’s weak password was compromised. Determining root cause is essential to plan effective remediation. If multiple factors contributed (common in complex incidents), note each one (technical and human factors).
  • Involve External Specialists if Needed: If the incident is sophisticated (e.g. advanced malware or a possible nation-state attack) or if HGA lacks certain forensic expertise, we may engage external incident response consultants to assist with the investigation. We also consider involving law enforcement at this stage if a crime is evident (e.g. data theft by external attackers) – law enforcement can sometimes provide indicators of compromise or information about known threat actors. (We coordinate such involvement via Legal Counsel to ensure it doesn’t conflict with our analysis.)
  • Investigation Documentation: From the start, we maintain a detailed incident log of all investigative steps and findings. This includes timelines of events, affected data lists, interview notes (if staff or users are interviewed for insight), and so forth. Article 33(5) of GDPR requires that the controller document the facts and effects of any personal data breach and remedial actions taken[18], and many laws similarly expect record-keeping. HGA’s incident report (Appendix A template) is used to capture this information, enabling after-action review and demonstrating compliance.

During investigation, internal updates are given regularly to HGA leadership. If at any point the investigation discovers that the incident is more severe than initially thought, containment actions are revisited (e.g. widen the scope of systems isolated) and notification plans may be accelerated.

Importantly, if the breach is ongoing or data is still at risk during analysis (for example, discovering a backdoor account still in the system), the team will loop back to Containment actions immediately to address it. Investigation and containment often run in parallel in the early stages.

4. Remediation (Eradication & Fix)

After understanding the breach and plugging any immediate holes, HGA will remediate the vulnerabilities and issues that led to the incident. The objective is to eradicate the threat from our environment and implement fixes so that the same type of breach cannot recur.

Remediation actions typically include:

  • Eliminate Threat Artifacts: Remove any malware, malicious files, or backdoor accounts left by attackers. For example, if a virus or ransomware was found, ensure all infected systems are cleaned and malware signatures are updated in anti-virus tools. If unauthorized user accounts or access tokens were created, delete or revoke them.
  • Apply Security Patches/Fixes: If the breach resulted from a software vulnerability, promptly apply the necessary patches or upgrades to fix that weakness on all relevant systems. HGA’s practice of regular updates and background patching[19] will be accelerated as needed in response to the incident. We also scan other systems for similar vulnerabilities. For instance, if a web server was breached due to an outdated library, all servers are updated and tested.
  • Improve Access Controls: If credential theft or weak authentication was a factor, strengthen controls. This may involve enforcing stricter password policies, requiring password resets for affected users, expanding multi-factor authentication coverage (HGA already uses MFA for all logins)[11], and reviewing user privileges. We ensure that least privilege principles are reinforced (e.g. limiting administrative access if that played a role).
  • Address Process or Configuration Gaps: If the root cause was a misconfiguration or process failure, correct it. For example, if a cloud storage bucket was accidentally left public, update its access settings and implement additional reviews for configurations. If an employee violated data handling procedures, provide remedial training or reinforcement of policies.
  • Enhance Monitoring and Alerts: Post-breach, we often improve monitoring to detect similar incidents in the future. This could mean adding new intrusion detection rules (based on patterns seen in the attack), increasing log retention or visibility, or deploying additional security tools. HGA’s platform includes a Security Management module that allows reviewing of logs and security event reports[13]; we use this to ensure any missed signs of the breach are now being monitored. Continuous security scanning is maintained to catch lingering threats[19].
  • Penetration Testing (if applicable): For significant breaches, after fixes are applied, HGA may conduct targeted penetration testing or vulnerability scanning of affected systems to verify that all known issues have been resolved and no new weaknesses were introduced.
  • Third-Party Remediation: If the breach involved or was exacerbated by a third-party service or vendor, coordinate with them to ensure they remediate on their side. For instance, if a breach occurred in a software we use (e.g. a zero-day exploit in a SaaS tool), work with the vendor to get confirmation of their fix. If the incident was due to a consultant’s personal device being compromised, ensure that device is cleaned and secure before it can reconnect to HGA systems, and update BYOD security requirements if needed.

All remediation steps taken are documented in the incident log, including the date completed. The IR Lead ensures nothing is overlooked by cross-checking the root causes with the actions taken.

Before declaring the incident fully remediated, the Incident Response Team does a verification: double-check that systems are free of threats and that new controls are effective. This might include reviewing system logs closely for a period after remediation to confirm no abnormal activity.

If personal data was involved, remediation also considers steps to mitigate harm to individuals. For example, if credit card numbers were compromised, as a remedial step HGA might arrange for credit monitoring services for affected persons or advise them on freezing credit (this also falls under notification, but the decision is part of remediation planning).

5. Recovery and Restoration

Once the threat has been neutralized and fixes applied, HGA moves into the recovery phase: bringing systems back to normal operation and assisting affected parties in recovering from the incident.

System Restoration: Any systems or services taken offline are safely restored. This may involve restoring data from backups if data was corrupted or lost. HGA maintains regular encrypted backups of critical data and has a Disaster Recovery Plan[20][21] to ensure business continuity. If we need to rebuild servers or deploy fresh instances (to ensure no malware persists), we do so using clean backups and verified code. We verify the integrity of restored data and systems before making them live. For example, after a ransomware attack, systems would be wiped and rebuilt from backups, tested, and then brought back online in stages.

Validate Business Functions: We confirm that all business processes (especially those critical to HGA’s consulting operations and the DevTender platform functionality) are running correctly. Any delayed work (due to systems being down) is prioritized once systems are up. The IRT coordinates with department heads to ensure everything is in order.

Communication in Recovery: Internally, the IR Lead gives a “all clear” or status update to staff once systems are restored, along with any instructions (e.g., if everyone needs to reset passwords, or if there are new security steps to follow after the incident). If certain services were unavailable to clients or consultants during containment, a message is sent announcing the restoration of service.

Support for Affected Individuals: If the breach impacted consultants, users, or others (e.g. their personal data was stolen), recovery includes helping those individuals mitigate any harm. Through our notification (see next section), we would have provided instructions for protecting themselves (like changing passwords, watching for suspicious activity, etc.). HGA sets up support channels (a helpdesk line or email) to address questions from affected parties. For a serious breach, we might assign staff to directly reach out to key clients or individuals to assist with recovery steps (for example, walking a client’s IT team through checking their accounts). In some cases, recovery can involve providing credit monitoring or identity theft resolution services free of charge for a period, if sensitive personal data (like ID numbers or financial info) was compromised – this decision would be made in remediation and executed in recovery.

Continuous Monitoring: After a breach, HGA will often implement heightened monitoring for a period of time. This is to detect any resurgence of the threat or copycat attempts. The security team stays on high alert and may produce daily incident reports to the IR Lead for a time. We leverage our continuous security monitoring and intrusion detection to verify that no further malicious activity related to the incident is occurring[7].

Incident Closure: The incident is formally closed only after confirming that: 1. All necessary steps in identification, containment, investigation, remediation, and recovery have been completed; 2. Notifications (internal and external) have been dispatched as required; 3. Systems are verified secure and operational; and 4. All incident documentation is finalized.

The IR Lead will prepare a summary “Incident Closure Report” for management, which recaps the incident and key outcomes. Any lessons learned or recommended follow-up actions (such as policy changes, user training enhancements, or further upgrades) are noted for action.

6. Post-Incident Review and Improvements

(Even though the question focuses on identification through recovery, we include this final step for comprehensiveness.)

HGA believes in continuous improvement. After every significant incident, the Incident Response Team will conduct a post-incident review (sometimes called a “post-mortem” or “lessons learned” session). The team and relevant stakeholders meet to discuss what happened and how our response went. We address questions such as: What worked well? What could be improved in our processes or tools? Were there warning signs missed? Did our team communicate effectively?

Findings from this review lead to concrete actions: – Update this Data Breach Response Policy or related procedures if gaps were identified. (For example, if the team lacked a certain tool or authority during the incident, adjust the plan.) – Improve security controls or monitoring based on the attack vectors observed. (E.g., if the breach came via phishing, enhance anti-phishing training and email filters.) – Provide additional training to staff or consultants if human error contributed to the incident (reinforce the confidentiality and security obligations that all have under the Consultant Agreement and internal policies). – If needed, conduct a drill or tabletop exercise to practice any new or changed response procedures. HGA is committed to regularly testing its incident response plan[22] – simulations and drills help keep the team ready and highlight any issues before a real incident occurs.

Finally, the DPO/Compliance Lead ensures that all records related to the breach (investigation notes, notifications, evidence, etc.) are stored securely as per regulatory requirements (for example, Canada’s PIPEDA requires keeping a record of all breaches for at least two years, even those not reported, and organizations must be able to furnish these if asked[23]). These records also enable oversight authorities (like GDPR supervisory authorities) to verify our compliance with notification duties[18].

Communication & Notification Protocols

One of the most critical aspects of breach response is how we communicate – both internally within HGA and externally to those affected and authorities. This section details who must be notified, when, and how, in accordance with legal obligations such as the EU General Data Protection Regulation (GDPR), U.S. state laws (e.g. California’s breach notification laws under CCPA/CPRA), and other global frameworks. HGA’s approach is to be transparent and timely in communications, without causing unnecessary alarm, and to meet or exceed the notification requirements of applicable laws.

Internal Escalation & Communication

Internal Alerts: As soon as a breach is suspected or confirmed, the Incident Response Lead will inform HGA’s senior management (and if applicable, the CEO or equivalent) about the situation. Initial details (what is known so far, immediate actions being taken) are provided. The purpose is to ensure leadership is aware of potential business or reputational impact and can allocate resources or make high-level decisions (like involving outside counsel or notifying clients proactively).

The IR Lead convenes the Incident Response Team members (via conference call or in person) and establishes an internal communication channel (e.g. a dedicated chat group or bridge line) for the incident. This channel is used for quick coordination among team members throughout the response.

Breach Notification Team: A subset of the IRT (including the DPO/Compliance, Legal, Communications lead, and relevant management) will specifically handle external notification strategy. They will decide when and how to notify regulators, affected individuals, partners, etc., based on the facts from the investigation and legal timelines. (Details in next section.)

Management & Board Updates: For significant incidents (High or Critical severity), the executive management will be briefed at least daily (or more frequently if developments occur) during the active response. If HGA has a board or advisory committee, they will be informed according to internal governance procedures (often at least a high-level summary of the incident and its impact once known). We avoid premature conclusions – updates focus on facts and actions underway. Management involvement ensures that if any strategic decisions or public disclosures (like press releases) are needed, they are properly vetted and approved.

Staff and Consultant Communication: If the breach affects the ability of staff or consultants to do their work (e.g., systems downtime, or if their own data is involved), HGA will communicate with them as well. For example, if we temporarily shut down the DevTender platform, we’d send an internal memo or email to all consultants explaining the outage (without yet disclosing sensitive breach details, unless/until appropriate). Moreover, if an employee or consultant’s credentials were stolen or their personal data was part of the breach, we will inform them individually as part of the “affected individuals” notification process (they shouldn’t learn about it from a public source first). The Consultant Agreement already obligates both HGA and consultants to notify each other of any breach involving the other’s personal data[2], so this policy reinforces that: consultants will be looped in if their data or accounts are compromised.

Confidentiality Internal: Until a breach is publicly disclosed, it will be on a need-to-know basis internally. We’ll instruct staff not on the Incident Response Team to refrain from spreading information, to prevent rumors and protect sensitive details. Internal announcements about the breach (outside of the IRT and management) will be carefully managed by the Communications Lead so employees get accurate information and know what (if anything) they should tell external parties if asked. We typically designate that all external inquiries (even from clients) be routed to a specific spokesperson or the communications team.

Attorney-Client Privilege: When Legal Counsel is involved in investigating the breach and crafting notifications, certain communications or reports may be done under legal privilege (especially in the U.S. context) to protect sensitive analysis from potential litigation. The Legal Counsel will advise on this if needed.

Notification Preparation: Concurrently, the Communications Lead (with DPO and Legal input) will start drafting the breach notification content so that it’s ready to go out as soon as it’s appropriate. Even if all details aren’t yet known, preparing a template or outline in advance saves time. We consider pre-prepared templates (like the sample in Appendix C) and then tailor them to the specific incident with the known facts (what happened, what data, etc.).

In summary, internal communication is about escalating quickly, keeping the right people informed, and maintaining control of information flow until official external notifications are made.

External Notifications & Regulatory Compliance

HGA will carry out all required external notifications in accordance with applicable laws and contractual obligations. External notification has several audiences: affected individuals (e.g. consultants, users, staff, or any persons whose data was breached), regulatory authorities, business clients/partners, and potentially law enforcement or public/media. Below, we outline the protocols for each:

Notification to Affected Individuals

If a data breach is likely to result in harm or risk to individuals’ personal data or privacy, HGA will notify those individuals without undue delay (once key facts are known and containment is in place). Under GDPR, if a breach poses a “high risk to the rights and freedoms” of data subjects, we are legally required to inform them directly and promptly[16]. Even outside GDPR, HGA’s policy is to notify individuals in a timely manner whenever their personal information is compromised in a way that could impact them (e.g., risk of identity theft or fraud).

Content of Individual Notices: Our communications to affected people will be clear, concise, and use non-technical language. We will include:

  • What Happened: A description of the incident in general terms, including when we discovered it. (For security reasons, we might not describe the specific attack vector in detail, but we give enough context, e.g. “unauthorized access to our database between X date and Y date.”)
  • What Information Was Involved: The types of personal data affected (e.g., names, contact info, dates of birth, account passwords, financial info, etc.). We will state if sensitive data like social security numbers or credit card numbers were exposed. If we’re unsure of specific data, we provide the categories likely involved.
  • What We Are Doing: Steps HGA has taken to contain and remediate the breach and to protect individuals. This may include stating that we fixed the vulnerability, what security measures we’ve enhanced, and that we have notified law enforcement or regulators if applicable. If we are offering any support (like credit monitoring services or identity theft protection) at HGA’s cost, we will mention how to enroll.
  • What You Can Do: Specific actions individuals should consider to protect themselves. We tailor this advice to the data involved[24][25]. For example, if passwords were exposed, we instruct them to reset passwords (and we may force a reset on our platform). If financial data was involved, we might advise monitoring bank statements or credit reports. For exposed SSNs or IDs, we would explain how to place fraud alerts or credit freezes[26][27]. We often attach or provide links to trusted guidance (such as an FTC or local authority identity theft resource) for additional steps[28]. The notice will include caution on avoiding phishing: e.g., we may tell individuals that we (HGA) will not call or ask for additional info by phone as a result of this incident, so any such contact claiming to be related could be fraudulent (this helps them avoid being re-victimized).
  • Contact Information: How the individual can obtain more information from HGA. We give a dedicated contact point – typically an email address or hotline – and the name and contact of our Data Protection Officer or incident contact person[15][29]. We also indicate if and where we will provide further updates (e.g. “check our website’s incident FAQ page for updates” or that future communications will be via email or mail only to prevent confusion).
  • Apology and Commitment: While keeping the tone factual, we usually express sincere regret for the inconvenience or concern caused and state that we take the matter seriously. We outline that we are committed to security and are taking steps to prevent such incidents in the future (to help rebuild trust).

The format may follow applicable law requirements. For instance, certain U.S. laws (like California) require the notice to have the title “Notice of Data Breach” and headings like “What Happened,” “What Information Was Involved,” “What We Are Doing,” “What You Can Do,” etc., with plain language and a certain font size[30]. HGA will comply with these formatting rules for notices sent to residents of those jurisdictions.

Delivery method: We will send individual notices via the most direct and secure method available. Typically, this is by email (if we have the individual’s email) or by physical mail if email is not available or appropriate. In some cases, other methods like SMS or a dedicated secure portal might be used if allowed and more effective. We follow any specific legal mandates – e.g., some laws allow substitute notice (posting on website or media) if contacting individuals directly is infeasible (e.g., lack contact info or too many affected). But our preference is direct notification whenever possible. Notices will be sent in the name of Humanics Global Advisors and include our contact details so recipients know it’s an official communication.

Timing: “Without undue delay” means we will not unnecessarily wait to notify individuals. We may take a short reasonable time to investigate and ascertain the scope of the breach and to implement initial containment (so that we can tell individuals accurate information and not compromise ongoing security efforts). However, any unjustified delay is to be avoided. As a rule of thumb, HGA aims to notify affected persons as soon as we have sufficient information to craft an informative notice and no later than when we notify regulators or as required by law. (For example, GDPR expects individual notices “as soon as possible” after determining high risk[16].) In practice, this often means within a few days of breach confirmation, subject to consultation with law enforcement (see below).

Law Enforcement Consultation: If a law enforcement agency is investigating the breach and requests that we delay notification to individuals (to avoid tipping off criminals or interfering with the investigation), we will document this request. Many laws allow for a reasonable delay in notification if law enforcement determines that immediate disclosure would impede a criminal investigation[31]. HGA’s Legal Counsel will obtain such request in writing and we will adhere to it, then notify individuals once the hold is lifted.

We maintain a sample breach notification letter (see Appendix C) as a template. Before sending notices, the DPO/Legal will ensure that the content meets any specific legal requirements for the jurisdictions of affected individuals. For instance, certain states require including information about credit bureaus if specific ID numbers were exposed[32], or offering identity theft services for free for a certain time if SSN or driver’s license is breached[33]. We will incorporate those elements as needed.

Once notifications are sent, we keep a record of when and how each individual was notified, in case we need to demonstrate compliance or follow up.

Notification to Regulatory Authorities

Where required by law, HGA will notify the appropriate government authorities or data protection regulators about the breach. The requirements vary by jurisdiction:

  • EU/UK (GDPR): If the breach involves personal data of individuals in the EU (or UK) and is likely to result in a risk to those individuals’ rights and freedoms, HGA (as a data controller) must notify the relevant Data Protection Authority (DPA) within 72 hours of becoming aware of the breach[3][34]. We adhere to this strict timeline. The DPO or Legal Counsel will prepare the notification report for the DPA. If HGA cannot gather all details within 72 hours (which can happen if the incident is complex), we will send an initial notification with the information we have and indicate that further details will follow (“notification in phases” is permitted)[18]. The notification to the DPA will include at least: a summary of the nature of the breach (e.g. categories and approximate number of data subjects and records involved)[14], the contact point for HGA (DPO’s details)[15], the likely consequences of the breach, and what measures we have taken or plan to take to address it[15]. We document the timing of when we became aware and when we notified, to show we met the 72-hour requirement or explain any delay. If the breach is unlikely to pose any risk (truly low risk), GDPR does not require notifying the authority; however, we will still document our risk assessment internally in case of later scrutiny[35][18].
  • United States (State Laws & Sectoral Laws): HGA operates globally, but for U.S. data, there is no single federal breach authority to notify (except in certain sectors like healthcare or finance). Instead, we must follow state breach notification laws. Almost all states require notifying the affected individuals (covered above) and many require notification to state regulators (often the state Attorney General or consumer protection office) if a certain number of residents are affected. For example, California law requires that if a breach affects more than 500 California residents, HGA must submit a sample copy of the breach notice to the California Attorney General’s Office[36]. We will comply with such state requirements: our Legal Counsel maintains a checklist of states with AG or other notifications and their thresholds (e.g., similarly, New York requires AG notification if >500 NY residents, etc.). We will send those regulator notifications either concurrently with or slightly before individual notices. Typically, these notices involve providing a copy of the letter we send to individuals and completing any online forms the state AG provides. Additionally, some states (like Massachusetts) require notifying a state agency and possibly credit bureaus if a large number of Social Security Numbers were involved. HGA will identify all relevant states based on the residency of affected persons and ensure we notify the required entities in each.
  • CCPA/CPRA (California): The California Consumer Privacy Act (as amended by CPRA) doesn’t have a separate breach notification mandate beyond existing CA breach law (CCPA primarily provides a private right of action for data breaches). The key obligation remains to notify individuals without unreasonable delay[4] and the AG if >500 affected. We ensure those are met. If the breach triggers potential CCPA liability (e.g., due to failure to implement reasonable security), Legal will be prepared for possible follow-up (like consumer claims) once it’s public.
  • Canada (PIPEDA): Under Canada’s PIPEDA, if the breach involves personal information under HGA’s control and it is reasonable to believe the breach creates a “real risk of significant harm” to individuals, we must report it to the Office of the Privacy Commissioner of Canada (OPC) and also notify affected individuals (unless prohibited by law)[37]. The timing under PIPEDA is “as soon as feasible” after determining the breach occurred[38]. We will make such report via the OPC’s reporting form, including details similar to GDPR (description, cause, data involved, number of people, steps taken, etc.), and we’ll notify individuals as discussed. Some Canadian provinces have their own laws (like Alberta’s PIPA requires reporting breaches to the Alberta commissioner without delay). HGA will comply as applicable.
  • Other jurisdictions: We acknowledge that many other countries have breach notification laws – for example, Australia (Notifiable Data Breaches scheme, where if serious harm is likely, notify OAIC and individuals “as soon as practicable”), Singapore (PDPA breach notification within 3 days to PDPC if significant harm or large scale), etc. If HGA’s breach involves data of individuals in other jurisdictions, the DPO/Legal will assess those countries’ requirements and ensure compliance. The general principle is similar: notify the privacy/data authority promptly (often within 72 hours or a few days) if certain harm or scope thresholds are met, and notify individuals unless an exception applies.
  • We will also check if any sector-specific regulators need notice. For instance, if the breach involves any credit card data, we may need to notify our payment processor and consider PCI-DSS obligations. If it involves health data (unlikely for HGA, but hypothetically), HIPAA/HITECH rules in the U.S. would require notifying HHS and possibly media if >500 people in a state. These are edge cases for HGA, but our legal team’s due diligence covers them.

Documenting regulatory contact: We keep copies of all notices sent to authorities and note the date/time of submission. If we miss a required notification inadvertently, we will rectify it as soon as discovered and explain the lapse to the authority transparently.

We also handle any follow-up inquiries from regulators. After notifying, a DPA or AG might have questions or require more info. The DPO/Legal will coordinate responses to such inquiries promptly. Our thorough incident documentation helps answer regulators’ questions about how the breach happened and what we’ve done.

Notification to Clients and Business Partners

Beyond individuals and government, HGA has obligations to notify certain partners, clients, or other organizations we work with, especially if the breach involves data we handle on their behalf or otherwise affects their interests:

  • Client Notification (as Data Processor or Vendor): If HGA processes or stores data for a client (i.e., in some cases we might act as a data processor to a client’s data), and we suffer a breach of that data, we are required to inform the client (the data controller) without undue delay[39]. For example, if HGA’s platform holds a client’s project information or personal data and that is compromised, we will contact that client as soon as possible to provide details, so they can in turn fulfill any obligations they have (such as notifying their stakeholders or regulators). This is often contractually required and in line with GDPR Article 33(2)[40] (which mandates processors notify controllers). HGA’s standard practice, reflected in contracts, is to notify partner organizations of incidents affecting them or their data promptly. The notice to a business client will usually be made by the HGA account manager or executive sponsor, in writing (email or letter), and contain a summary of what happened, what data of theirs is affected, and what we are doing. It will also outline any immediate steps the client might need to take on their side.
  • Upstream/Downstream Partners: If a third-party vendor or service provider of HGA was compromised and that led to our data being exposed, that vendor is expected to notify us (and we require in our contracts that they do). Once we receive such notice, our IRT treats it like an internal breach and we will then notify any impacted parties as if it were our own incident. Conversely, if HGA’s breach could impact another organization (for instance, if an HGA consultant’s credentials for a client system were stolen or if data we share with a partner was exposed), we will inform that organization. An example: if HGA and a partner share an integrated system and the partner’s data in our possession is breached, we notify the partner so they can take protective measures.
  • Notification to Consultants: Our consultants are both individuals and part of our business network. If the breach involves consultant data (e.g., personal info consultants provided to HGA, or perhaps their CV or credentials database on DevTender), we will notify those consultants (as “affected individuals”). Additionally, if the breach could affect ongoing consulting engagements (say a project data was leaked), we may need to inform the client and possibly the team on that project. We coordinate such communication so that it’s clear and doesn’t cause undue alarm. The Consultant Contract explicitly requires mutual notification of breaches[2], which we honor through these protocols.
  • Internal Cross-Notifications: If the breach originated with one of our offices or a subsidiary, HGA will notify the parent entity or any affiliated entities as needed. (This may not be applicable if HGA is a single entity, but if there are multiple legal entities or joint ventures, ensure all need-to-know entities are informed.)

All partner notifications should be made as soon as practical after initial containment and fact-finding – usually within a few days of the incident. They may happen even earlier than individual notifications if, for example, we need a client’s cooperation in the response.

We will usually designate a specific HGA representative (e.g. an Account Manager or senior exec) to be the liaison for each major client or partner being notified, to handle their concerns directly.

In the notifications to partners/clients, we will emphasize confidentiality if appropriate (many companies wouldn’t want it widely known they were affected). We may enter into a joint communication plan with them if the incident overlaps both organizations.

Law Enforcement and Other External Parties

Law Enforcement: HGA will consider involving law enforcement authorities especially when the breach involves criminal activity (such as theft of data by hackers, fraud, or an extortion attempt like ransomware). In many cases, notifying law enforcement is recommended or required. For instance, the U.S. Federal Trade Commission advises promptly reporting breaches involving identity theft risk to local police and possibly the FBI or Secret Service[41]. Our Legal Counsel will typically reach out to appropriate law enforcement early on – for example:

  • If personal data theft or fraud is suspected, file a report with local police or national cybercrime units. This creates an official record.
  • For cyber intrusions, contacting the FBI’s cybercrime unit or national cyber incident response (if in the US, or similar agencies in other countries) can be appropriate, especially for large breaches.
  • If the incident involves mail theft or something physical, possibly the Postal Inspection Service (per FTC guide)[41].
  • For breaches involving certain sectors (like if any government data were involved), notify relevant authorities as required by contract or law.

We balance this with any regulatory disclosures. Law enforcement notification does not replace regulatory notification – it’s an additional step. We also heed any guidance from law enforcement about what to communicate to the public or individuals. As noted, if they ask us to delay public/individual notice to avoid impeding investigation, we will comply (within legal allowances).

Insurance: If HGA carries cyber liability or data breach insurance, an early notification to our insurance carrier is necessary (often within a strict timeframe like 24-48 hours of discovery) to ensure coverage. The Incident Response Lead or Risk Manager will ensure the insurer is notified according to the policy requirements, and we may utilize any incident response services provided by the insurer.

Professional Bodies or Other Oversight: Depending on the nature of data, we may need to inform other parties. For example, if the breach involves personal data of EU citizens and we have appointed an EU representative under GDPR, we will inform the representative. If any certifications (like ISO 27001) are held that require reporting incidents, we handle that through our compliance team.

Media / Public Communication: In some cases, especially large-scale breaches, HGA might issue a press release or public statement. Sometimes laws even require media notification (for instance, U.S. healthcare breaches over 500 individuals in one state require notifying prominent media in that area). Even if not required, we may proactively do a press release if we expect the news to spread or if we want to assure the public of our actions. The Communications Lead, with management and legal approval, will craft any press release. It will contain similar information as individual notices, but tailored for public consumption. We will not divulge more personal detail than necessary, and we’ll express empathy and control of the situation. We also might publish a notice on our website and/or social media channels if appropriate.

If HGA posts breach updates on a web page, we will direct individuals to that page for ongoing status. This can help prevent misinformation and reduce direct inquiries.

Note on Timing of Public Disclosure: We generally will notify affected individuals and regulators before any broad public disclosure. This way, our direct stakeholders hear it from us first rather than the news. Only after those notifications are underway or completed would we release information publicly.

Cross-Border Considerations

Because HGA operates globally (with data subjects and clients in multiple jurisdictions, and data possibly stored in cloud servers across borders), we take special care to meet cross-border data transfer and notification requirements:

  • As noted in our Consultant Agreement, HGA adheres to GDPR principles even if not strictly required, and consultants consent to cross-border data handling with appropriate safeguards[42]. In a breach scenario, this means if a breach occurs in one region but involves data of individuals from another (e.g., a breach in a U.S. system exposing EU personal data), we will coordinate notification with both regions’ laws (GDPR and relevant U.S. law).
  • Lead Authority: Under GDPR, if we operate in multiple EU countries, we might deal with a lead supervisory authority. Our DPO will determine if a lead DPA is relevant and notify them, and they in turn share info with other concerned DPAs as needed (per GDPR cooperation mechanisms).
  • Language: Notifications to individuals will be in an appropriate language for the recipient where feasible. (For example, if we have a large number of data subjects in France affected, we’d consider sending notices in French or providing translation, to ensure clarity.)
  • Differing Thresholds: We keep track that different countries have different thresholds for notifying authorities (some have any risk, some have “real risk of significant harm” like Canada[37], etc.). Our policy is usually to err on the side of notification if in doubt. It’s better to over-inform than under, to maintain trust.
  • Privacy Shield/Transfers (if applicable): Although not directly a notification issue, if the breach involves data transferred from the EU to the US under some transfer mechanism, we may have to communicate with those frameworks (e.g., inform the EU data exporter or adhere to commitments like those under Privacy Shield – though that framework is now defunct, similar concepts in new frameworks may exist). The key point: cross-border breaches often involve multiple regulators (like both the EU DPA and a US state AG). We will address each and ensure consistency in our disclosures.

In summary, HGA’s external notification strategy is comprehensive and compliant: we notify individuals quickly and helpfully, authorities within required timeframes, clients/partners proactively to manage shared risk, law enforcement to address crime, and the public/media if needed to maintain transparency. All communications will be professional, factual, and aimed at protecting our stakeholders and our organization’s integrity.

Appendices

The following appendices provide templates and tools to support the implementation of this policy. They are meant to be adapted as needed during an incident.

Appendix A: Incident Report Log Template

Each security incident should be documented in an Incident Report Log. Below is a template of key information to record for each incident:

  • Incident ID: (Unique number or code for reference.)
  • Date/Time Discovered: (When the incident was first detected or reported.)
  • Date/Time Incident Began (if known): (Approximate start of incident, if determinable.)
  • Reporter Name/Contact: (Who initially reported or detected the incident.)
  • Incident Description: (Summary of what occurred, e.g. “SQL injection attack resulted in data exposure”. Include what systems or data are affected.)
  • Affected Systems/Applications: (List of servers, devices, databases, or services impacted.)
  • Affected Data (Type and Volume): (What information is compromised – e.g. “Customer personal data – names, emails of 5,000 users”. Include sensitivity classification if applicable.)
  • Affected Individuals/Clients: (Who is impacted – internal (staff) and external (clients, users)? Provide counts and any specific names if needed. E.g. “All consultants in our database” or “Client X’s project files”.)
  • Incident Severity Classification: (Low/Moderate/High/Critical – see Appendix B for criteria – and reasoning for this classification.)
  • Containment Actions Taken: (What immediate steps were done to control incident spread or damage, and when. E.g. “10:30 AM – Disabled compromised user account”, “11:00 AM – Took server offline”.)
  • Investigation Findings: (Key results from analysis: attack vector, root cause, vulnerabilities exploited, etc. Bullet points of findings. E.g. “Malicious code found in payment page (Magecart script)”, “Root cause: out-of-date library not patched”. Include timeline of attacker activity if known.)
  • Root Cause Analysis: (Detailed cause of incident and contributing factors. E.g. “SQL injection due to missing input validation on form X”, “Firewall misconfiguration allowed unauthorized access”.)
  • Remediation Actions: (List of fixes implemented. E.g. “Applied patch KB1234 to all servers”, “Removed malware from endpoints”, “Reset all user passwords”, “Improved firewall rules”.)
  • Recovery Actions: (How systems/data were restored to normal. E.g. “Restored database from backup dated X”, “Rebuilt server”, etc. Also note if business operations resumed fully.)
  • Notifications – Internal: (Who within HGA was informed and when. E.g. “CTO notified on 5/1/25 2PM”, “All staff informed of service outage on 5/2/25 9AM”.)
  • Notifications – External: (List all external notifications made or required. Include regulators (with dates notified), affected individuals (dates sent), clients/partners (dates/points of contact), law enforcement (date reported, agency, case number if any), etc. E.g. “72-hour report to ICO submitted on 5/3/25”, “Emails sent to 2,300 affected users on 5/4/25”, “Notified Client ABC on 5/2/25 4PM by phone and follow-up email”.)
  • Impact Assessment: (Summary of impact: data loss quantified, financial cost if estimated, business downtime, potential harm to individuals identified. E.g. “No evidence of data misuse so far; potential risk is phishing of 500 users’ emails.”)
  • Incident Status: (Open/Contained/Resolved/Closed – and date closed.)
  • Lessons Learned/Follow-up: (Any notes for future prevention: e.g. “Need to implement additional training on phishing”, “Deploy Web Application Firewall”, “Update incident response plan regarding third-party notifications”. Include any scheduled follow-up actions and owners.)

This log should be updated in real-time as the incident progresses. Maintaining a comprehensive log not only helps coordinate the response but also serves as evidence of HGA’s diligence and as a knowledge base for improving security.

Appendix B: Data Breach Classification Chart

Not all incidents are equal. HGA classifies data breaches into severity levels to guide response urgency and notification decisions. The criteria below provide a general framework:

Severity Level

Description / Criteria

Example Incidents

Low (Minor)

Scope: Isolated incident, low volume of data, and Data Sensitivity: non-sensitive or already public information. Impact: Little to no harm likely to individuals or operations.

• Lost or stolen device with full disk encryption enabled (no accessible data) <br>• Single staff email sent to wrong internal recipient without sensitive data <br>• Minor website defacement with no data loss

Moderate

Scope: Limited data or systems affected, or low-sensitivity data of a larger group; or sensitive data of very few people. Impact: Some disruption or potential harm, but largely contained and not likely to cause serious damage.

• Phishing attack where a few employee email accounts were accessed, potentially exposing internal emails <br>• Small database (e.g. names and emails) of clients leaked <br>• Malware outbreak on some office PCs detected quickly, minimal data exfiltrated

High (Significant)

Scope: Large volume of data exposed, or highly sensitive personal data (PII, financial, health, credentials) for any number of individuals; or core system compromise. Impact: Significant risk of harm to individuals (identity theft, fraud) or major business impact. Likely triggers legal notification requirements.

• Database breach exposing customer personal details (names, contact info, login credentials, or ID numbers)[17] <br>• Ransomware attack encrypting critical servers, disrupting operations (even if data not confirmed stolen) <br>• An insider copied confidential client files (PII) and exfiltrated them

Critical (Severe)

Scope: Very large-scale breach (majority of records in system) or extremely sensitive data (financial accounts, biometric, highly regulated data) compromised. Impact: Severe or catastrophic effect – individuals face serious harm (identity theft, financial loss), business operations crippled, or breach is publicly widespread. Immediate comprehensive response needed.

• Hacker group exfiltrated entire client database including financial info and social security numbers, and posted online <br>• Breach of the platform’s production database across regions, affecting all consultants’ and clients’ personal data <br>• Supply chain attack compromising HGA’s software and in turn breaching multiple clients’ systems (broad cascading impact)

Usage: During incident assessment, the Incident Response Team assigns a severity level based on these criteria. The level dictates escalation: High and Critical incidents require immediate executive attention, all-hands response, and likely external notifications (regulators and individuals) without delay. Moderate incidents are handled with urgency but might be contained internally if risk is low (though partners or small groups might be notified). Low incidents can be managed routinely with minimal notification (perhaps just internally). This classification also helps prioritize resource allocation – e.g., a Critical severity breach may activate a 24/7 response until resolved.

The examples provided are illustrative; actual classification will consider specifics of the incident (number of records, legal implications, etc.). If in doubt, HGA will err on treating an incident as one level higher to ensure a robust response.

Appendix C: Sample Breach Notification Letter to Individuals

Below is a template letter that can be used to notify affected individuals of a data breach. It should be customized with the specific details of the incident as determined at the time of writing. This sample is written in a clear, plain-language style and includes the key information that should be communicated.

[HGA Letterhead]
Notice of Data Breach

Date: [Month Day, Year]

Dear [Name of Affected Individual],

What Happened:
We are writing to inform you of a recent data security incident at Humanics Global Advisors (HGA) that may have involved some of your personal information. On [Date of Discovery], we discovered that [briefly describe the incident – e.g., “an unauthorized party gained access to one of our user databases”]. Our investigation indicates that the incident occurred on [Date of Incident if known] and was detected on [Date]. Upon discovery, we immediately took steps to contain the incident and secure our systems.

What Information Was Involved:
The incident potentially involved your personal information associated with the HGA Digital Platform. Specifically, the data that may have been exposed includes: [list categories of personal data – e.g., your name, email address, phone number, and date of birth]. Importantly, no financial account passwords or Social Security numbers were involved in this incident. (If certain sensitive data like SSN or payment info was involved, mention it clearly, e.g. “included your [last 4 digits] of your Social Security number” or “your credit card number”. If data was encrypted or otherwise protected, note that too.)

What We Are Doing:
HGA has taken swift action in response to this incident. We have contained the breach and engaged cybersecurity experts to thoroughly investigate and ensure the security of our platform. We have fixed the vulnerability that allowed this incident to occur and implemented additional safeguards to prevent such an event from happening again. This includes [examples: “deploying enhanced monitoring tools” or “requiring a platform-wide password reset”]. We have also notified law enforcement and are cooperating with any investigation. In addition, we have reported this matter to relevant data protection authorities as required[34]. Protecting your data is our top priority, and we deeply regret that this incident occurred despite our security measures.

What You Can Do:
At this time, we have no evidence of misuse of your information; however, we encourage you to remain vigilant. Please consider taking the following steps to protect yourself:

  • Change Your Password: If you use the same password on any HGA platform or other accounts that you used before, please change it immediately. Choose a strong, unique password and avoid reusing passwords across sites.
  • Monitor Your Accounts: Watch for any suspicious emails, calls, or activity. Be cautious of unsolicited communications asking for personal information. Check your financial account statements and credit reports over the next few months for any unusual activity.
  • Enable Fraud Alerts or Credit Freeze (if applicable): Since contact information was exposed, as a precaution you may place a free fraud alert on your credit file or consider a credit freeze with the major credit bureaus. This can help prevent potential identity thieves from opening accounts in your name. (Contact information for the credit bureaus: Equifax 1-800-525-6285, Experian 1-888-397-3742, TransUnion 1-800-680-7289.)
  • Remain Vigilant: We have attached a sheet with additional guidance on protecting yourself after a data breach, including how to obtain free credit reports and recognize signs of identity theft. Please review these recommendations and follow those that are applicable to your situation.

(If HGA is offering any support, include here, e.g.: “Free Credit Monitoring: We are offering you a complimentary 12-month membership to [Service], which provides credit monitoring and identity theft insurance. Instructions for enrollment are attached. We encourage you to take advantage of this service as an extra precaution.”)

For More Information:
We understand that you may have questions or concerns. You can find more information and updates on this incident at [HGA’s incident webpage URL]. If you need assistance or have further questions about this incident or how to protect your information, please contact our dedicated response team at [Phone Number] or [Email Address]. Our team is ready to help and answer your questions. For general information on identity theft and fraud prevention, you may also visit the FTC’s website at IdentityTheft.gov for guidance.

We sincerely apologize for this situation and any inconvenience it may cause you. HGA values your trust, and we are committed to strengthening our security and making sure something like this does not happen again. Your privacy and security are of utmost importance to us.

Sincerely,

[Name]
[Title]
Humanics Global Advisors

End of letter template.

Notes: In using this template, insert the appropriate details where placeholders are indicated (e.g., nature of breach, data types, dates). Tailor the protective advice to the data involved (for instance, if financial info was leaked, include more on contacting banks; if only emails were leaked, focus on phishing vigilance). Ensure the tone is professional yet empathetic, and avoid speculative or overly technical language. The letter should ideally fit on one or two pages for clarity. Always review the final content for compliance with any specific legal requirements in the recipient’s jurisdiction (such as mandatory headings or state-specific advice).

[1] [2] [42] HGA_Consultant_Contract_Template.docx

file://file-GA7v2hdnXhXEYmWj3q3gXG

[3] [14] [15] [18] [40] Art. 33 GDPR – Notification of a personal data breach to the supervisory authority – General Data Protection Regulation (GDPR)

https://gdpr-info.eu/art-33-gdpr/

[4] [30] [31] [32] [33] California | Summary of U.S. State Data Breach Notification Statutes | Davis Wright Tremaine

https://www.dwt.com/gcp/states/california

[5] [6] [7] [8] [11] [13] [19] [20] [21] [22] HGA_Digital_Platform_Technical_Specifications.pdf

file://file-LERZnDM52Sh8kLN2RatZB5

[9] [16] [29] [34] [35] [39] Personal data breaches: a guide | ICO

https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/

[10] [12] [24] [25] [26] [27] [28] [41] Data Breach Response: A Guide for Business | Federal Trade Commission

https://www.ftc.gov/business-guidance/resources/data-breach-response-guide-business

[17] 4 Severity Levels of Breaches – Low to Critical | Aldridge

https://aldridge.com/4-severity-levels-of-breaches-low-to-critical/

[23] [37] [38] Mandatory privacy breach reporting requirements coming into force in Canada November 1 | Canada | Global law firm | Norton Rose Fulbright

https://www.nortonrosefulbright.com/en/knowledge/publications/ac3ee5c4/mandatory-privacy-breach-reporting-requirements-coming-into-force-in-canada-november-1

[36] Data Security Breach Reporting | State of California – Department of Justice – Office of the Attorney General

https://oag.ca.gov/privacy/databreach/reporting