Breach Notification Procedure

Touch2Sign Ltd

Version: 1.0

Effective date: 11 July 2026

Owner: [DPO / Privacy Lead]

Approved by: Robert — CEO / Managing Director

Next review: 11 July 2027

---

1. Purpose

Define how Touch2Sign assesses personal data breaches and meets notification obligations under GDPR Articles 33–34, UK GDPR, and customer DPA commitments. This procedure complements the Incident Response Plan — IR handles containment; this procedure handles regulatory and data subject notification decisions.

2. Scope

Applies when a security incident may involve:

• Unauthorised access to personal data
• Accidental loss or destruction of personal data
• Unauthorised alteration of personal data
• Personal data disclosed to unauthorised recipients

Includes breaches at Touch2Sign and sub-processors (AWS, Stripe, OneID, eID Easy, Anthropic, etc.) affecting Touch2Sign customer data.

3. Definitions

Personal data breach (GDPR Art 4(12)): a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Not every security incident is a personal data breach — e.g. encrypted data exfiltrated with keys intact may not be notifiable if risk to rights and freedoms is unlikely.

4. Roles

Role	Responsibility
DPO / Privacy Lead	Breach assessment; authority notification; Art 34 decision
Incident Commander	Coordinates IR; provides technical facts
CEO / Comms	Customer (controller) notification; public statements
Legal counsel	Regulatory strategy; high-risk breach advice

Primary contact: privacy@touch2sign.com

5. Timeline overview

Milestone	Target
Incident detected → DPO notified	30 minutes (P1/P2)
Initial breach assessment complete	24 hours
Supervisory authority notification (if required)	72 hours from awareness
Customer (controller) notification	Without undue delay
Data subject notification (if required)	Without undue delay after Art 33

Awareness = when Touch2Sign has a reasonable degree of certainty that a personal data breach has occurred.

6. Breach assessment workflow

Execute in parallel with Incident Response Plan Phase 3.

6.1 Assessment checklist

• [ ] Did a personal data breach occur? (Art 4(12))
• [ ] When did Touch2Sign become aware?
• [ ] What categories of personal data? (names, emails, IDV, document content, IP addresses)
• [ ] Approximate number of data subjects and records
• [ ] Likely consequences for data subjects
• [ ] Risk to rights and freedoms — high or low?
• [ ] Was data encrypted such that it remains unintelligible to unauthorised parties?
• [ ] Touch2Sign role: processor (notify customer controllers) or controller (direct Art 33)?
• [ ] Sub-processor involved? (Contact vendor; document in incident register)

6.2 Notification decision matrix

Scenario	ICO / DPC (Art 33)	Data subjects (Art 34)	Customers (controllers)
Encrypted data lost; keys secure	Likely not required	Likely not required	Inform if contract requires
Email addresses exposed; phishing risk	Notify	Consider notify	Notify without undue delay
Customer documents exposed	Notify	Likely notify	Notify immediately
IDV results exposed	Notify	Notify	Notify immediately
Internal admin error; no external access	Document; likely not notify	Not required	Case by case
Sub-processor breach affecting Touch2Sign data	Assess; notify if Touch2Sign is controller	Per Art 34	Notify customers as processor

When uncertain, DPO errs toward notification within 72 hours.

7. Supervisory authority notification (72 hours)

7.1 Ireland (DPC) — Touch2Sign Ltd primary establishment

• Website: https://www.dataprotection.ie/
• Phone: +353 578 684 800
• Use official breach notification form

7.2 UK (ICO) — if UK data subjects materially affected

• Website: https://ico.org.uk/for-organisations/report-a-breach/
• Phone: 0303 123 1113

7.3 Required content (Art 33(3))

1. Nature of the personal data breach including categories and approximate numbers
2. DPO contact details (privacy@touch2sign.com)
3. Likely consequences of the breach
4. Measures taken or proposed to address the breach and mitigate harm

If full information unavailable at 72 hours, provide in phases without undue further delay.

8. Customer notification (processor role)

Touch2Sign acts as processor for most customer document and signer data. On breach affecting customer data:

1. Notify affected customer organisations (controllers) without undue delay per DPA §4
2. Provide facts needed for their own Art 33/34 obligations
3. Do not publicly name customers without agreement

Use template from Incident Response Plan §6.2; customise with confirmed facts only.

9. Data subject notification (Art 34)

Required when breach is likely to result in high risk to rights and freedoms of individuals, unless:

• Data was encrypted (Art 34(3)(a))
• Subsequent measures eliminate high risk (Art 34(3)(b))
• Disproportionate effort — public communication instead (Art 34(3)(c))

Notification in clear and plain language:

• Nature of the breach
• DPO contact
• Likely consequences
• Measures taken and recommended user actions (e.g. change password, beware phishing)

Coordinate with customer controllers — they may lead communication to their signers.

10. Documentation

Every breach assessment recorded regardless of notification outcome:

Field	Description
Breach ID	BRH-YYYY-NNN (link to INC-YYYY-NNN)
Date aware	UTC
Description	Factual summary
Data categories
Subjects affected	Count / range
Art 33 required?	Y/N + rationale
Authority notified	DPC / ICO / NA + date
Art 34 required?	Y/N
Customers notified	Y/N + date
Remediation
Closed date

Retain 3 years minimum.

11. Link to Incident Response Plan

IR Plan section	Breach procedure link
§5 Phase 3 — Assessment	Use this procedure's checklist
§6.2 Customer template	Processor notification
§6.3 ICO/DPC template	Supervisory authority
§7 Touch2Sign playbooks	Technical facts for assessment
§9 Incident register	Link BRH ID to INC ID

Full incident response: INCIDENT_RESPONSE_PLAN.md

12. Related documents

• Incident Response Plan
• DSAR Procedure
• Data Processing Agreement
• Vendor & Sub-processor Management Policy
• Information Security Policy

13. Review

Reviewed annually, after any notifiable breach, and when supervisory authority guidance changes.

---

Approval

Name	Role	Signature	Date
Robert	CEO	Electronic	11 July 2026
	DPO / Privacy Lead