Data Breach Response Policy
How MindBrood Initiative identifies, responds to, and notifies data breaches
This policy is issued in compliance with Section 40 and related provisions of the Nigeria Data Protection Act 2023 (NDPA), which requires data controllers to establish and document procedures for detecting, managing, and notifying personal data breaches. It applies to all Societrics platforms operated by MindBrood Initiative.
1. Purpose and Scope
This policy documents MindBrood Initiative's procedures for detecting, assessing, containing, and notifying personal data breaches affecting the Societrics platform ecosystem. It applies to all personal data processed by MindBrood Initiative across all platforms: app.societrics.org, ph.societrics.org, dashboard.societrics.org, and labs.societrics.org.
It covers breaches affecting data stored in Firebase Firestore, Firebase Authentication, Firebase Storage, local backup systems, third-party processors (including Anthropic API session data), and any physical records containing personal data.
2. What Constitutes a Personal Data Breach
Under the NDPA 2023, a personal data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored, or otherwise processed by MindBrood Initiative.
This includes but is not limited to:
- Unauthorised access to Firestore or Firebase Authentication by an external attacker
- Accidental deletion or corruption of assessment records or account data
- A Firebase Security Rules misconfiguration that exposes individual assessment records to unauthorised reads
- Unauthorised access to admin credentials or service account keys
- A field enumerator's tablet containing unsynced assessment data being lost or stolen
- Paper response cards containing community assessment responses being lost, stolen, or disclosed to unauthorised parties
- Accidental bulk-disclosure of user email addresses (e.g., in a misdirected email)
- A third-party processor (including Anthropic, Google Cloud) notifying us of a breach affecting data we have shared with them
- Insider access — an employee, contractor, or partner accessing data beyond their authorised scope
A breach of confidentiality in the professional marketplace (a counsellor disclosing session content) may also constitute a personal data breach where personal data is involved. See Section 7.
3. Breach Severity Classification
| Severity | Description | Examples | Response timeline |
|---|---|---|---|
| Critical | Widespread exposure of personal data, including data of minors; potential for significant harm to data subjects | Database dump of user records exposed; Firebase rules misconfiguration exposing all assessment records; Anthropic API breach affecting student AI Advisor conversations | Immediate containment; NDPC notification within 72 hours; user notification as soon as practicable |
| High | Significant unauthorised access or disclosure of personal data; moderate risk of harm | Admin credentials compromised; small number of records accessed without authorisation; lost tablet with unsynced assessments | Containment within 4 hours; NDPC assessment within 24 hours; notification if threshold met |
| Medium | Limited breach; personal data involved but low risk of direct harm to data subjects | Lost paper response cards (no names, only LGA/demographics); accidental email CC of user list to a small number of staff | Containment within 24 hours; documented assessment; NDPC notification if threshold met |
| Low | Minimal personal data involved; no foreseeable risk of harm | Single user's session token accidentally logged in a non-public system log; anonymous pH session ID briefly visible in a debug trace | Document; contain; no external notification required unless circumstances change |
4. Roles and Responsibilities
| Role | Responsibility |
|---|---|
| Data Protection Lead (Founder/CEO) | Ultimate responsibility for breach response; authorises NDPC notifications; approves user communications; engages legal counsel where required |
| Technical Lead | Leads technical containment; assesses scope and nature of breach; implements technical remediation; preserves forensic evidence; updates Firebase Security Rules and access controls |
| Field Operations Lead (where breach involves field data) | Coordinates response for lost or compromised field devices or paper records; retrieves and accounts for unsynced data; notifies field team |
| All Staff and Contractors | Report any suspected breach immediately to the Data Protection Lead; do not attempt independent remediation without authorisation; do not disclose a breach externally before the Data Protection Lead has assessed it |
5. Detection and Initial Assessment
A breach may be detected through multiple channels: automated Firebase security alerts; reports from users or data subjects; reports from field supervisors or enumerators; notifications from third-party processors (Google Cloud, Anthropic); staff or contractor observation; or external security researchers.
5.1 Reporting a Suspected Breach
Any person who suspects or discovers a breach — staff, contractor, field enumerator, user, or third party — must report immediately to:
Email: security@societrics.org
Direct contact: Data Protection Lead — research@societrics.org
Include in your report: what you observed, when you observed it, which systems or data were involved, and any actions you have already taken.
5.2 Initial Assessment (within 1 hour of detection)
The Technical Lead assesses:
- What data was involved — category, estimated volume, and whether it includes data of minors
- How the breach occurred — the technical or procedural cause
- Whether the breach is ongoing or contained
- What risk the breach poses to data subjects — possibility of identity theft, discrimination, reputational harm, financial loss, or physical harm
- Provisional severity classification (Critical / High / Medium / Low)
6. Containment and Remediation
Immediate containment actions depend on breach type:
| Breach type | Immediate containment actions |
|---|---|
| Unauthorised database access | Revoke compromised credentials immediately; update Firebase Security Rules; rotate service account keys; audit access logs to determine scope |
| Security Rules misconfiguration | Deploy corrected rules immediately; audit Firestore logs to identify what data was accessed and by whom; assess duration of misconfiguration |
| Lost or stolen field device (tablet) | Remote-wipe device if MDM-enrolled; revoke device's Firebase auth credentials; determine which responses were stored but not yet synced; notify affected respondents if identifiable |
| Lost paper response cards | Assess what personal data was on the cards; determine if cards can be recovered; document the loss; assess if any respondents are identifiable from the content |
| Compromised admin or staff credentials | Immediately disable compromised account; force password reset; audit access logs for the period of compromise; revoke any tokens issued under compromised credentials |
| Third-party processor breach | Obtain full details from the processor; assess which Societrics data was affected; follow the processor's incident response guidance; apply Sections 7 and 8 as appropriate |
After immediate containment, the Technical Lead documents the full remediation plan including any system changes, rule updates, process improvements, and additional safeguards to prevent recurrence. Remediation must be completed and documented before the incident is closed.
7. Notification Obligations
7.1 Notification to the Nigeria Data Protection Commission (NDPC)
Where a breach is likely to result in a risk to the rights and freedoms of data subjects — which applies to all Critical and High severity breaches as classified in Section 3, and to any breach involving data of minors regardless of severity — MindBrood Initiative must notify the NDPC within 72 hours of becoming aware of the breach.
The NDPC notification must include:
- Description of the nature of the breach, including categories and approximate number of data subjects and records involved
- Name and contact details of the Data Protection Lead
- Likely consequences of the breach
- Measures taken or proposed to address the breach and mitigate its effects
NDPC Contact: ndpc.gov.ng — Breach notifications submitted through the NDPC's official reporting portal or by direct contact as directed on their website.
Where it is not possible to provide full information within 72 hours, an initial notification is submitted with available information, and supplementary information is provided as it becomes available. The reason for delay must be documented.
7.2 Notification to Affected Data Subjects
Where a breach is likely to result in a high risk to the rights and freedoms of data subjects — including breaches involving data of minors, special category data, financial data, or any breach that could enable identity theft, discrimination, or physical harm — MindBrood Initiative must notify the affected individuals directly, without undue delay.
The notification to data subjects must:
- Be written in plain, clear language — not legal jargon
- Describe what happened, what data was involved, and the likely impact
- Describe the steps MindBrood Initiative has taken to contain and remediate the breach
- Advise the data subject on steps they can take to protect themselves (e.g., change passwords, monitor for suspicious activity)
- Provide contact details for the Data Protection Lead for any questions
- Inform data subjects of their right to complain to the NDPC
Where a breach involves data of students enrolled through a school, the school administrator (as data controller for their students) must be notified promptly so that the school can notify parents and guardians in accordance with their own data protection obligations.
Where individual notification is not reasonably practicable (e.g., the breach affected anonymous users who cannot be individually identified), a prominent public notice is published on the Societrics website for a minimum of 30 days.
8. Record-Keeping
All personal data breaches — regardless of severity — must be documented in the Breach Register maintained by the Data Protection Lead. The register records:
- Date and time of discovery
- Date and time of occurrence (if known)
- Nature, category, and approximate volume of data involved
- Cause and how the breach occurred
- Severity classification and justification
- Containment actions taken and timeline
- Whether NDPC was notified and when; confirmation reference number
- Whether data subjects were notified and when
- Remediation plan and completion status
- Lessons learned and preventive measures implemented
The Breach Register is retained for a minimum of 5 years from the date of each entry, consistent with the NDPA's record-keeping requirements. It is available for inspection by the NDPC on request.
9. Post-Incident Review
Within 30 days of closing any Critical or High severity incident, MindBrood Initiative conducts a post-incident review to:
- Confirm that all remediation actions have been completed
- Assess whether existing security controls, access management procedures, or training were inadequate
- Identify specific improvements to prevent recurrence
- Update this policy, security procedures, or training materials as required
- Determine whether the incident has any ongoing legal, regulatory, or reputational implications requiring further action
The post-incident review findings are documented and added to the Breach Register entry for the relevant incident.
10. Third-Party Processor Breaches
MindBrood Initiative requires all third-party data processors — including Google (Firebase), Anthropic, and any payment processors — to notify us of any breach affecting Societrics data within 24 hours of their becoming aware of it, under the terms of their data processing agreements with us.
Upon receiving notification of a processor breach, MindBrood Initiative treats the notification as discovery of a breach for the purposes of our own 72-hour NDPC notification obligation, and applies this policy accordingly. We do not rely on processors to notify data subjects on our behalf.
11. Training
All staff, contractors, and field supervisors with access to personal data receive training on this policy as part of their onboarding. Refresher training is conducted annually or after any significant incident. Training covers:
- What constitutes a personal data breach and how to recognise one
- How to report a suspected breach immediately
- The prohibition on attempting independent remediation or external disclosure without authorisation
- Field-specific scenarios (lost devices, paper records, community session confidentiality)
12. Contact
To report a suspected or confirmed data breach:
Email: security@societrics.org
Backup: research@societrics.org
Nigeria Data Protection Commission (NDPC): ndpc.gov.ng
This is an internal operational policy published for transparency. It is reviewed annually and updated whenever relevant Nigerian law or our technical infrastructure changes materially. Version history is maintained in the internal document management system.