Data Breach Response Policy

Defines procedures for responding to data breaches, exposures, and security incidents

Data Breach Response Policy

Field Value
Document ID POL-008
Classification Internal
Owner CTO (interim CISO)
Effective Date April 2026
Review Cycle Annual

1. Overview

This policy mandates that any individual who suspects that a theft, breach or exposure of Wealthy Protected data or Wealthy Sensitive data has occurred must immediately provide a description of what occurred via e-mail to security@wealthy.in.

This e-mail address is monitored by Wealthy’s Information Security Administrator. This team will investigate all reported thefts, data breaches and exposures to confirm if a theft, breach or exposure has occurred. If a theft, breach or exposure has occurred, the Information Security Administrator will follow the appropriate procedure in place.

2. Purpose

The purpose of the policy is to establish the goals and the vision for the breach response process. This policy will clearly define:

  • To whom it applies and under what circumstances
  • The definition of a breach
  • Staff roles and responsibilities
  • Standards and metrics (e.g., to enable prioritization of the incidents)
  • Reporting, remediation, and feedback mechanisms

The policy shall be well publicized and made easily available to all personnel whose duties involve data privacy and security protection.

Wealthy Information Security’s intentions for publishing a Data Breach Response Policy are to focus significant attention on data security and data security breaches and how Wealthy’s established culture of openness, trust and integrity should respond to such activity.

Wealthy Information Security is committed to protecting Wealthy’s employees, partners and the company from illegal or damaging actions by individuals, either knowingly or unknowingly.

3. Scope

This policy applies to all who collect, access, maintain, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle personally identifiable information (PII) or Protected Health Information (PHI) of Wealthy members.

4. Policy

4.1 Incident Response Process

As soon as a theft, data breach or exposure containing Wealthy Protected data or Wealthy Sensitive data is identified, the process of removing all access to that resource will begin.

The Director will chair an incident response team to handle the breach or exposure. The team will include members from:

  • IT Infrastructure
  • IT Applications
  • Finance (if applicable)
  • Legal
  • Communications
  • Member Services (if member data is affected)
  • Human Resources
  • The affected unit or department that uses the involved system or output or whose data may have been breached or exposed
  • Additional departments based on the data type involved
  • Additional individuals as deemed necessary by the Director

Confirmed Theft, Breach or Exposure

The Director will be notified of the theft, breach or exposure. IT, along with the designated forensic team, will analyze the breach or exposure to determine the root cause.

Work with Forensic Investigators

As provided by Wealthy cyber insurance, the insurer will need to provide access to forensic investigators and experts that will determine:

  • How the breach or exposure occurred
  • The types of data involved
  • The number of internal/external individuals and/or organizations impacted
  • Root cause analysis

Develop a Communication Plan

Work with Wealthy communications, legal and human resource departments to decide how to communicate the breach to:

  1. Internal employees
  2. The public
  3. Those directly affected

4.2 Ownership and Responsibilities

Roles & Responsibilities

Role Responsibilities
Sponsors Members of the Wealthy community that have primary responsibility for maintaining any particular information resource. May be designated by any Wealthy Executive in connection with their administrative responsibilities, or by the actual sponsorship, collection, development, or storage of information.
Information Security Administrator Member designated by the Executive Director or the Director, Information Technology (IT) Infrastructure, who provides administrative support for the implementation, oversight and coordination of security procedures and systems with respect to specific information resources in consultation with the relevant Sponsors.
Users Virtually all members of the Wealthy community to the extent they have authorized access to information resources, and may include staff, trustees, contractors, consultants, interns, temporary employees and volunteers.
Incident Response Team Chaired by Executive Management. Includes, but is not limited to: IT-Infrastructure, IT-Application Security, Communications, Legal, Management, Financial Services, Member Services, Human Resources.

5. Policy Compliance

5.1 Compliance Measurement

The Infosec team will verify compliance to this policy through various methods, including but not limited to, periodic walk-throughs, video monitoring, business tool reports, internal and external audits, and feedback to the policy owner.

5.2 Exceptions

Any exception to the policy must be approved by the Infosec team in advance.

5.3 Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.