Incident response

How Visible responds to a personal information breach affecting school data. This supports Board risk assessments; detailed response procedures sit with Visible and in the school MoU where needed.

1. What counts as an incident

Unauthorised access, disclosure, loss, or alteration of school personal information we hold, including incidents at a subprocessor that affect Visible-hosted school data.

2. Our response

1. Contain the incident and investigate.
2. Assess whose information is affected and the likely harm.
3. Notify the school’s nominated privacy / security contact.
4. Cooperate with the school on any further notifications they must make.

3. Notification timeline

Target: initial notice to the school within 72 hours of Visible confirming a personal information breach that affects that school.

Notice will cover, so far as known: what happened at a high level, categories of information that may be involved, containment steps taken, recommended next steps for the school, and a Visible contact for follow-up.

The school remains responsible for deciding whether and how to notify individuals and the Office of the Privacy Commissioner.

4. Contact

Report a suspected incident: support@visible.education (subject: Security incident). Urgent after-hours contacts, if any, are in your MoU.

Related: Privacy Policy · Subprocessors