1. Scope

1.1 This procedure applies to all personal data held by MediaTuig B.V., trading as New Way Work (“we”): client data we process on behalf of our clients under our Data Processing Agreement (the “DPA”), and our own business data, for which we are controller. It also covers our editing team, PT Starianti Administrative Center in Indonesia.

1.2 A personal data breach is a breach of security that leads to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or access to, personal data. Examples in our work:

• a laptop, drive or render machine with footage or proxies is lost or stolen;

• a project, deliverable or review link is shared with the wrong person or client;

• someone gains unauthorised access to one of our accounts, for example in My NWW, the editor chat or a client’s Blackmagic Cloud library;

• footage is deleted or corrupted without a backup to restore it from; or

• an email with personal data is sent to the wrong recipient.

1.3 A suspected breach follows this procedure until we have ruled it out.

2. Detection and internal reporting

2.1 Every team member who notices or suspects a breach reports it immediately to the founder, who coordinates the response. Team members report even when they are unsure: a report that turns out to be harmless is better than a delay.

2.2 Our editors report to PT Starianti, and PT Starianti notifies us within 24 hours after becoming aware of a breach.

2.3 We can also learn of a breach from a client or a third party, during our weekly maintenance round, or through our periodic security scans. Security researchers can report vulnerabilities as described in our Responsible Disclosure policy.

2.4 We become aware of a breach when we have a reasonable degree of certainty that a security incident has occurred that has compromised personal data. The deadlines in this procedure run from that moment.

3. Containment

3.1 Our first step is to stop the breach and limit its effects. Depending on what happened, we for example:

• reset passwords, revoke sessions and remove access for affected accounts;

• remove shared links or access to projects;

• disconnect an affected device or service from our systems;

• ask the recipient of misdirected data to delete it and confirm this; and

• restore lost or altered data from our encrypted backups.

3.2 We keep the information needed to understand the breach, such as logs and messages, and do not delete it while the investigation runs.

4. Risk assessment

4.1 We establish what happened, which data and which people are affected, approximately how many, and whose data it is: data of a client, or our own.

4.2 We then assess the likely consequences for the people concerned. We take into account the type of data (for example footage showing people in a confidential context, or special categories of personal data such as health information), the amount of data, whether the data was encrypted, how easily people can be identified, and who may now have the data.

4.3 For client data, the client as controller makes the final decision on notifying its supervisory authority and the people concerned. We share our assessment to support that decision. For our own data, we make that decision ourselves.

5. Notifying the client

5.1 If a breach affects client data, we notify the client without undue delay after becoming aware of it. We send the notification in writing to the client’s contact person.

5.2 The notification contains, as far as the information is available:

• the nature of the breach, including, where possible, the categories and approximate number of people and of personal data records concerned;

• the name and contact details of the person the client can contact about the breach;

• the likely consequences of the breach; and

• the measures we have taken or propose to take, including measures to limit possible adverse effects.

5.3 If we cannot provide all information at once, we provide it in phases without undue further delay. We keep the client informed until the breach is closed.

6. Supporting the client

6.1 The client decides whether to notify its supervisory authority and the people concerned, and makes those notifications. We help by providing the information the client needs, answering its questions and, where possible, helping to identify the people affected, for example by finding the footage in which they appear.

6.2 We do not notify a supervisory authority or the people concerned on behalf of a client unless the client instructs us to do so in writing.

7. Our own notifications as controller

7.1 Where we are controller, for example for the contact details of our prospects and clients, our administration or applicants’ data, we notify the Autoriteit Persoonsgegevens within 72 hours after becoming aware of the breach, unless the breach is unlikely to result in a risk to the people concerned. We use the authority’s online notification form.

7.2 If a breach is likely to result in a high risk to the people concerned, we also inform them without undue delay, in clear language, with advice on what they can do to protect themselves.

8. Breach register

8.1 We record every personal data breach in our breach register, including breaches that we did not have to notify.

8.2 For each breach we record: when it happened and when we became aware of it, what happened, which data and people were affected, which client was involved, our risk assessment, the notifications we made and when, the measures we took, and the reasons for our decisions, including a decision not to notify.

8.3 On request, we make the relevant information from the register available to the client concerned or to the supervisory authority.

9. Post-incident review

9.1 After each breach, we review its cause and our response. We decide which measures, tools or instructions need to change to prevent a similar breach, and we record those actions in the breach register.

9.2 We share the lessons learned with our team and with PT Starianti, and we inform the client concerned about the outcome of the review where its data was affected.

9.3 Our wider security measures are described on our Information Security page.

10. How to report a suspected breach to us

10.1 If you suspect a breach involving data we hold, email info@newwaywork.nl with the subject “Data breach”.

10.2 Please include what you noticed, when it happened, which project, link or account is involved, and how we can reach you. Do not include more personal data than needed to describe the problem.

10.3 We treat every report as a possible breach until we have ruled it out. If you have found a security vulnerability rather than a breach, see our Responsible Disclosure policy.