Breach Notification Procedure

1. Purpose

This Breach Notification Procedure sets out the steps OurClub will take in the event of a personal data breach, in accordance with Articles 33 and 34 of the UK GDPR and the Data Protection Act 2018. It ensures that breaches are detected, reported, investigated, and documented in a timely and consistent manner.

As a data processor, OurClub is obligated to notify data controllers (clubs) without undue delay upon becoming aware of a personal data breach. This procedure applies to all OurClub staff and contractors who process personal data.

2. What Constitutes a Personal Data Breach

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed. This includes, but is not limited to:

• Unauthorised access to systems or databases containing personal data.
• Accidental disclosure of personal data to unauthorised recipients (e.g. sending member data to the wrong club).
• Loss or theft of devices or media containing personal data.
• Ransomware or other malware attacks that affect the availability or integrity of personal data.
• Accidental deletion of personal data without adequate backups.
• Social engineering attacks resulting in the disclosure of personal data or credentials.
• Exposure of API tokens, Stripe webhook secrets, database credentials, or other secrets, whether in source code, logs, or third-party systems.
• Unauthorised access to, or enumeration of, the OurClub API, including token theft, session hijacking, or bypass of rate-limiting controls.
• Compromise of the mobile application binary, or a mobile-specific vulnerability that could expose personal data stored on-device or in transit.

3. Discovery and Initial Response

Upon discovery or notification of a suspected personal data breach, the following steps must be taken immediately:

• Contain: Take immediate steps to contain the breach and limit its impact. This may include isolating affected systems, revoking compromised credentials, or disabling affected user accounts.
• Assess: Determine the nature and scope of the breach, including the type of personal data affected, the number of data subjects affected, and the likely cause.
• Record: Begin documenting the breach immediately, recording the date and time of discovery, the nature of the breach, and all actions taken.
• Escalate: Notify the Data Protection Officer (DPO) or senior management without delay.

4. Risk Assessment

Following containment, a risk assessment must be conducted to determine the severity of the breach and the likelihood of harm to data subjects. The assessment should consider:

• Type of data: Whether the breach involves sensitive data (e.g. children's data, financial information, health data).
• Volume: The number of individuals and records affected.
• Context: Whether the data could be used to cause harm (e.g. identity theft, financial loss, discrimination).
• Containment: Whether the breach has been fully contained and whether the data can be recovered.
• Recipient: Whether the data was disclosed to a known or unknown recipient, and whether that recipient can be trusted.

The risk should be classified as one of the following:

• Low: Unlikely to result in a risk to the rights and freedoms of data subjects. No notification to the ICO is required, but the breach must be recorded.
• Medium: A risk to the rights and freedoms of data subjects exists. Notification to the ICO is required within 72 hours.
• High: A high risk to the rights and freedoms of data subjects exists. Notification to the ICO is required within 72 hours, and affected data subjects must also be notified without undue delay.

5. 72-Hour Notification to the ICO

Where a breach is likely to result in a risk to the rights and freedoms of individuals, OurClub shall assist the data controller (the club) in notifying the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required by Article 33 of the UK GDPR.

As a processor, OurClub's primary obligation is to notify the controller (the club) without undue delay. The controller is then responsible for determining whether ICO notification is required. OurClub shall provide all information necessary for the controller to make this determination and to complete the notification.

If the full details of the breach are not available within 72 hours, an initial notification should be made with available information, and further details provided in phases as they become available.

6. Notification to Data Controllers (Clubs)

As a data processor, OurClub must notify affected data controllers (clubs) without undue delay after becoming aware of a personal data breach. This notification shall include:

• A description of the nature of the breach, including the categories and approximate number of data subjects and records concerned.
• The name and contact details of OurClub's Data Protection Officer or other contact point for further information.
• A description of the likely consequences of the breach.
• A description of the measures taken or proposed to address the breach and mitigate its effects.
• Guidance on the club's own notification obligations to the ICO and to data subjects, where applicable.

Notification to clubs shall be made via the email address associated with the club's OurClub account and, where possible, through an in-platform notification.

7. Notification to Data Subjects

Where a breach is likely to result in a high risk to the rights and freedoms of individuals, the data controller (the club) is required to notify affected data subjects without undue delay, as required by Article 34 of the UK GDPR. OurClub shall assist controllers in communicating with affected data subjects where requested.

The notification to data subjects should be in clear, plain language and should include:

• A description of the nature of the breach.
• The name and contact details of the Data Protection Officer or other contact point.
• A description of the likely consequences of the breach.
• A description of the measures taken or proposed to address the breach, including advice on steps the data subject can take to protect themselves (e.g. changing passwords, monitoring bank accounts).

8. ICO Notification Format

When notifying the ICO, the following information must be provided (or provided in phases if not all immediately available):

• The nature of the personal data breach, including the categories and approximate number of data subjects and records concerned.
• The name and contact details of the Data Protection Officer or other contact point.
• A description of the likely consequences of the breach.
• A description of the measures taken or proposed to address the breach and mitigate its adverse effects.

The ICO can be notified via their online personal-data breach reporting tool at ico.org.uk/for-organisations/report-a-breach or by calling 0303 123 1113.

9. Record Keeping

In accordance with Article 33(5) of the UK GDPR, OurClub shall maintain a record of all personal data breaches, regardless of whether they are reportable to the ICO. The record shall include:

• The facts relating to the breach (date, time, nature, cause).
• The effects and consequences of the breach.
• The remedial actions taken.
• The reasoning behind decisions taken (e.g. why notification was or was not made to the ICO or data subjects).
• The names and roles of individuals involved in the response.

Breach records shall be retained for a minimum of five years and shall be made available to the ICO upon request.

10. Post-Breach Review

Following the resolution of a breach, OurClub shall conduct a post-breach review to identify the root cause, evaluate the effectiveness of the response, and implement improvements to prevent recurrence. The review should consider:

• Whether existing security measures were adequate.
• Whether the breach response was timely and effective.
• Whether additional technical or organisational measures are needed.
• Whether staff training needs to be updated.
• Whether this procedure needs to be revised.

Findings from post-breach reviews shall be documented and incorporated into OurClub's security and data protection practices.

11. Roles and Responsibilities

• All staff and contractors: Responsible for reporting suspected breaches immediately to the DPO or senior management.
• Data Protection Officer (DPO): Responsible for assessing the breach, coordinating the response, notifying affected controllers (clubs), and maintaining breach records.
• Technical team: Responsible for containment, investigation, and implementing technical remediation measures.
• Senior management: Responsible for strategic decisions regarding breach response, resource allocation, and external communications.

12. Contact

To report a suspected data breach or for questions about this procedure, please contact our Data Protection Officer at [email protected].

Security researchers who believe they have discovered a vulnerability should report it to [email protected] in line with the Security Research section of our Acceptable Use Policy. Good-faith researchers acting within those terms will not be subject to legal action.

For general enquiries, contact [email protected].