HR Data Breach Policy

HR Data Breach Policy

Purpose

This policy establishes the responsibilities, procedures, and required timeframes for identification, containment, investigation, notification, and remediation of incidents involving unauthorized access, disclosure, alteration, or destruction of Company data, including personal data of employees, customers, vendors, and other third parties. Compliance with this policy is mandatory for all employees, contractors, and third-party agents with access to Company information systems or records.

Scope

This policy applies to all information assets owned, managed, or processed by the Company, including electronic systems, paper records, mobile devices, cloud services, and portable media. It governs incidents that may reasonably result in unauthorized access to or disclosure of sensitive or regulated information.

Definitions

"Data breach" means an actual or reasonably suspected unauthorized acquisition, access, use, or disclosure of Company data that compromises the confidentiality, integrity, or availability of that data. "Personal data" means information that can be used to identify an individual either directly or in combination with other data elements.

Roles and Responsibilities

The following functions have primary responsibilities during and after a suspected breach:

- Human Resources: coordinate employee notifications, manage employee communications and support, and ensure compliance with internal personnel policies.

- Information Technology / Incident Response Team: contain the incident, preserve evidence, perform forensic analysis, remediate vulnerabilities, and restore services.

- Legal: evaluate regulatory obligations, coordinate external notifications to affected individuals and authorities where required by law, and advise on legal risk mitigation.

Reporting and Initial Response

Any employee who discovers or suspects a data breach must immediately report the incident without undue delay. Reports should be made to both HR and IT Incident Response. Do not attempt to investigate or remediate the incident independently unless directed by Incident Response.

HR Contact:   Phone:

IT Incident Response Lead:   Phone:

Legal Contact:   Phone:

Incident Response Procedures

1. Identification and Triage — Document the date and time the incident was discovered: Date discovered: . Classify the affected data type(s) below.

Affected data types (check all that apply): Personally Identifiable Information (PII) Protected Health Information (PHI) Financial Data Intellectual Property Other

2. Containment — IT will take immediate steps to contain the incident, which may include isolating affected systems, disabling compromised accounts, and blocking network traffic.

3. Investigation and Forensics — Preserve logs and evidence. Investigative actions will be documented in an incident record maintained by IT and Legal.

4. Risk Assessment and Notification Determination — Legal will determine whether notification to affected persons or regulators is required and recommend the timing and content of such notifications.

Notification Requirements

The Company will notify affected individuals and required authorities in accordance with applicable legal obligations. Where notification is required, the Company aims to provide notice no later than:

Notifications will contain a summary of the incident, types of information involved, steps individuals can take to protect themselves, and Company contact information for assistance.

Data Classification and Handling

All Company data must be handled according to its classification. Access to sensitive data is granted on a need-to-know basis and protected by appropriate administrative, technical, and physical safeguards.

Employee Obligations

Employees must: (a) report suspected breaches immediately; (b) follow instructions from Incident Response; (c) not access or disclose breached information except as directed; and (d) cooperate with investigations. Failure to comply may result in disciplinary action up to and including termination.

Training and Prevention

The Company will provide periodic data breach response and data protection training. Employee attestation of training completion: I acknowledge I have received and completed required training

Recordkeeping and Review

A record of all incidents and related decisions will be maintained for a period consistent with Company records retention policy and legal obligations. This policy will be reviewed periodically and updated as necessary.

Enforcement

Violations of this policy will be investigated and may result in corrective or disciplinary action, including termination, civil liability, and referral for criminal prosecution where appropriate.

Acknowledgment & Employee Information

Position Information

Employment History

Education

References (Professional)

Legal Disclosures

At-Will Employment: Employment with the Company is at-will and may be terminated by either the employee or the Company at any time, with or without cause and with or without notice, unless a written agreement signed by authorized Company personnel states otherwise.

Equal Opportunity: The Company is an equal opportunity employer. Decisions regarding hiring, promotion, and discipline are based on job-related qualifications and business needs, without unlawful discrimination.

Applicant Certification & Authorizations

I certify that all information provided in this form is true, complete, and correct to the best of my knowledge. I understand that materially false information may result in corrective action, including termination.

I certify that the information provided is true and complete.

Authorization to Contact Previous Employers and Conduct Background Checks:

I authorize the Company to contact prior employers and to conduct background and reference checks as required for employment, consistent with applicable law.

Employee Acknowledgment

I acknowledge that I have received, read, and understand the HR Data Breach Policy. I agree to comply with the procedures and reporting requirements set forth herein and to cooperate with any investigation relating to an incident.

Sign Now