Incident procedure — EduRegie

What to do in the event of a (suspected) data breach or security incident. Goal: act correctly within the statutory deadline (72 hours after the school becomes aware, 48 hours for us as processor towards the school — see article 7 of the data processing agreement).

Step 1 — Detection

Anyone (an Elhoucine Automation employee, or a user who notices something unusual) reports a suspicion immediately, even if it is still uncertain. Report via: info@elhoucineautomation.nl.

Examples of incidents: unauthorized access to the database, an incorrectly configured n8n workflow that sends notifications to the wrong recipient, a leaked API key or service-role key, loss of a device with access.

Step 2 — Initial triage (within a few hours)

1. Confirm whether it actually involves personal data and which school(s)/data subjects may be affected.
2. Limit the damage immediately: for a leaked key — rotate the key (Supabase service-role key, n8n API key, credential in n8n); for a faulty workflow — set it to inactive (see docs/productie-runbook.md, Rollback section).
3. Record: what happened, when discovered, which systems/data, initial estimate of scope.

Step 3 — Notification to the school (within 48 hours of becoming aware)

Send the school (Controller) a notification with:

• nature of the incident;
• (suspected) categories and number of data subjects/records affected;
• measures taken and proposed follow-up measures;
• contact person for further questions.

The school itself is responsible for any notification to the Data Protection Authority (within 72 hours of their own awareness) and, in case of high risk, to the data subjects themselves — we provide the information needed for that.

Step 4 — Investigation and remediation

• Identify the root cause.
• Fix the vulnerability structurally, not just the symptom.
• Document the timeline and measures taken for the incident file.

Step 5 — Follow-up

• Evaluate whether additional measures are needed (see Security Annex).
• Update this procedure if the evaluation reveals a gap.
• Retain the incident file in accordance with the Data Retention Policy.

Points of contact