Personal Data Breach Policy

Clouds Nest Solutions Ltd · Published 1 October 2026

What this covers

A breach can involve lost, altered, destroyed or improperly disclosed personal information, or access by an unauthorised person. Examples include a compromised account, an exposed export, misdirected email or lost device. This policy applies to Clouds Nest business information and customer data processed through the platform.

Report immediately

Personnel and contractors must alert Clouds Nest management as soon as a suspected incident is identified. Preserve relevant evidence and record when the issue was discovered. Do not conceal the incident, delete logs or send sensitive records through an insecure channel. Customers should use their agreed support or incident route; the public contact form is also available for initial reporting.

Respond and assess

• Contain the incident and protect affected accounts, devices and services.
• Record what happened, the information involved, affected people and action taken.
• Assess potential harm and coordinate with relevant suppliers and customers.
• Identify notification obligations and document the decision, including when notification is not required.
• Investigate the cause and apply corrective measures.

Notification responsibilities

When Clouds Nest is a processor, it must notify the relevant controller without undue delay after becoming aware of a personal data breach and provide information to support the controller’s response. When Clouds Nest is the controller, report a notifiable breach to the ICO without undue delay and, where feasible, within 72 hours of awareness. High-risk breaches require communication to affected individuals without undue delay unless an applicable exception applies.

Follow-up

Management must keep an incident record, review the response and update access, training or working procedures where necessary. A public website report does not replace urgent internal escalation.