Incident Response
Procedure.
Pintop’s incident-response framework supports the detection, reporting, containment, investigation, recovery, communication and review of security events that may affect personal data, systems or services.
A structured response when something goes wrong.
This procedure describes Pintop’s approach to actual, suspected or imminent security incidents that may affect personal data, systems, infrastructure, integrations or service availability.
It applies where Pintop acts as a data controller and where Pintop processes personal data for a client under an applicable service agreement or Data Processing Agreement.
The objective is to reduce harm, preserve evidence, restore secure operations, meet applicable obligations and use each incident to strengthen the relevant controls and processes.
A breach can affect
confidentiality, integrity or availability.
A personal data breach may involve accidental or unlawful destruction, loss, alteration, disclosure or access.
Confidentiality breach
Personal data is viewed, received, copied or disclosed by a person who is not authorised to access it.
Integrity breach
Personal data is altered, corrupted or changed without proper authority or through an unintended system or process failure.
Availability breach
Personal data or a system containing it becomes unavailable, destroyed or inaccessible when it is legitimately required.
Incidents may be identified through several channels.
A report is assessed based on what happened, the systems and information involved, the people affected and the potential operational or personal impact.
The incident-response
lifecycle.
Each event is managed through a structured sequence, while urgent containment and investigation may occur in parallel.
Report and record
Capture the initial report, discovery time, affected service, observed behaviour, available evidence and reporter contact information.
Triage and assess
Determine whether the event is a security incident or personal data breach and assess its likely scope, severity and immediate risks.
Contain
Limit further access, disclosure, alteration, data loss or service disruption while preserving information needed for investigation.
Investigate
Establish what happened, when it happened, how it occurred, which systems and records were involved and which controls failed or were bypassed.
Assess obligations
Consider contractual, regulatory, client and data-subject notification requirements based on the nature and likely impact of the incident.
Recover
Remediate the cause, restore trusted systems and data, validate security controls and return affected services to normal operation.
Review and improve
Record lessons learned, assign corrective actions and update products, controls, processes, training or documentation where required.
Response priority follows the potential impact.
Severity is assessed using the type and sensitivity of information, number of people affected, scope of access, operational disruption, likely harm and available containment measures.
Critical
A widespread or systemic incident involving highly sensitive information, major service compromise or a significant likelihood of serious harm.
High
Confirmed unauthorised disclosure, access or disruption with material impact but a more limited scope than a critical incident.
Medium
A contained incident involving limited information or systems, with a lower but still meaningful risk requiring investigation and remediation.
Low
A minor event with little realistic impact, limited exposure and straightforward containment or correction.
Containment protects the
next moment.
Response actions are selected according to the affected system, evidence available and the risks created by continuing or interrupting the service.
Isolate affected systems
Restrict network, environment, service or integration access where continued connection could increase the impact.
Secure credentials
Revoke or rotate affected passwords, tokens, API keys, sessions and other credentials.
Preserve evidence
Protect relevant logs, records, alerts, configuration, messages and system information from alteration or loss.
Remediate the cause
Correct vulnerable configuration, code, access, workflow or process conditions that contributed to the incident.
Restore trusted data
Recover from verified backups or other trusted sources after confirming integrity and addressing the root cause.
Increase monitoring
Resume services with focused monitoring, validation and review to detect recurrence or incomplete remediation.
The response must establish what actually happened.
Investigation connects technical evidence, processing context, affected information and operational decisions into an understandable incident record.
Notification depends on role, risk and applicable obligations.
Each incident is assessed to determine which clients, affected individuals, regulators, service providers or other parties must be informed and when that communication is required.
Incident response requires
coordinated responsibility.
The people involved depend on the affected product, system, client, information and operational impact.
Data protection
Assesses personal-data impact, coordinates relevant privacy obligations and supports regulatory or data-subject communication.
Engineering and infrastructure
Contains technical impact, preserves evidence, investigates system behaviour, remediates causes and restores trusted services.
Product and service ownership
Provides processing context, client impact, service dependencies, workflows and product-specific information.
Client and stakeholder communication
Coordinates accurate and approved communication with clients, users, partners and other affected stakeholders.
Leadership
Supports material decisions, resource allocation, escalation, business continuity and accountability for corrective actions.
The incident record supports accountability and improvement.
Relevant incidents are documented so that decisions, notifications, evidence, remediation and lessons remain traceable after normal operations resume.
Readiness is built
before an incident.
Response capability depends on preparation, clear reporting routes and regular review of the systems and responsibilities involved.
Awareness
Relevant personnel receive guidance on recognising, preserving and reporting suspected incidents.
Exercises
Scenario reviews or simulations may be used to test communication, decision-making and recovery readiness.
Continuous improvement
Findings from incidents, testing, audits and product changes are used to improve the response framework.
Found something that may affect a Pintop system or personal data?
Use the security issue route and include enough information for the team to identify the affected product, understand the observed behaviour and begin a safe investigation.
Related security and
privacy documents.
These documents provide additional information about Pintop’s privacy governance, risk assessment, system use and reporting framework.