Data Breach Response Plan

A 'personal data breach' is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

• Automated alerts from monitoring, WAF, EDR and cloud provider controls.
• Staff reports through the internal incident reporting channel.
• External reports from users, partners, security researchers or regulators.

Any suspected incident must be reported immediately to the Security Incident Lead at support@aiah.health. The Incident Lead convenes the response team (Engineering, DPO, Legal, Communications) and starts an incident log.

• Isolate affected systems (revoke credentials, rotate keys, quarantine hosts).
• Preserve evidence (logs, memory captures, disk images).
• Prevent further exposure while investigation proceeds.

AIAH.Health is built encryption-first. Before any risk assessment is finalised, the Incident Lead must record the encryption status of every dataset in scope, because encryption materially changes whether a breach is notifiable under Articles 33 and 34 UK GDPR.

• Confirm whether the affected data was encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Confirm whether the affected fields were protected by end-to-end encryption, where the decryption keys are held only by the member and are never available to our infrastructure or staff.
• Confirm the location, custody and integrity of the corresponding encryption keys, and whether any key material was itself exposed.
• Rotate or revoke any key, token or credential that may have been exposed, and re-key affected records where technically possible.
• Record the assessment and its evidence in the incident log.

Where affected data was end-to-end encrypted, or otherwise strongly encrypted with keys that were not compromised, the data is rendered unintelligible to any unauthorised party. In those circumstances the breach is unlikely to result in a high risk to individuals and notification to individuals under Article 34 may not be required. We still log the incident, still assess ICO notification on its own facts, and will notify individuals voluntarily where transparency is in their interests.

Where key material was or may have been compromised, the incident is treated as if the data were unencrypted and the full notification path applies.

The DPO assesses the likelihood and severity of risk to individuals' rights and freedoms, considering: type and volume of data affected; identifiability; encryption status and key custody as recorded above; ease of exploitation; special category data involvement; and potential consequences (financial, reputational, safeguarding, physical).

If the breach is likely to result in a risk to individuals, the DPO notifies the ICO without undue delay and, where feasible, within 72 hours of becoming aware. Notification includes: nature of the breach, categories and approximate number of individuals and records, contact for the DPO, likely consequences, and measures taken or proposed. Where information is not immediately available it is provided in phases.

Where the breach is likely to result in a high risk to individuals, we notify affected people without undue delay in clear and plain language, describing what happened, likely consequences, measures taken and steps they can take to protect themselves. Where direct notification is disproportionate we make a public communication or equivalent measure.

Every incident (whether or not notifiable) is recorded in the personal data breach register with: facts, effects, remedial action, decisions taken and rationale. Records are retained for 6 years.

Engineering leads a technical investigation to establish root cause. The DPO documents findings and required remediation. Where a third-party processor is involved, we require them to co-operate and provide evidence.

• Restore services from clean, verified backups following our disaster recovery playbook.
• Maintain a communications plan for customers, partners and regulators.
• Test business continuity annually.

A post-incident review is completed within 30 days of closure and its actions tracked to completion. Lessons feed into policy, controls and training updates.

We test this plan through a tabletop exercise at least annually and after any material change in systems or team.