Incident response

How Visible responds to a personal information breach affecting school data. This supports Board risk assessments; detailed response procedures sit with Visible and in the School Services Terms where needed.

1. What counts as an incident

Unauthorised access, disclosure, loss, or alteration of school personal information we hold, including incidents at a subprocessor that affect Visible-hosted school data.

2. Our response

1. Contain the incident and investigate.
2. Assess whose information is affected and the likely harm.
3. Notify the school’s nominated privacy / security contact.
4. Cooperate with the school on any further notifications they must make.

3. Notification timeline

Target: initial notice to the school without undue delay, and in any event within 72 hours of Visible becoming aware of an actual or reasonably suspected personal information breach that affects that school. That first notice may be brief and may say the matter is under investigation.

Notice will cover, so far as known: what happened at a high level, categories of information that may be involved, containment steps taken, recommended next steps for the school, and a Visible contact for follow-up.

The school remains responsible for deciding whether and how to notify individuals and the Office of the Privacy Commissioner.

4. Contact

Report a suspected incident: support@visible.education (subject: Security incident). Urgent after-hours contacts, if any, are in your school agreement.

Related: Terms · Privacy Policy · Subprocessors