# Personal data breach policy
This document describes the procedure which we will follow in the event of a breach of personal information. It has been prepared with reference to current best practice guidelines (opens new window) and in consultation with our technical and legal teams.
# Procedure during a breach
- Notify the regulator as per the POPI act (opens new window)
- Notify all clients of an ongoing investigation
- Suspend all incoming services until the results of an internal investigation have been completed
- Conduct the internal investigation and produce a report of:
- List the extent of the breach (which users were impacted at each client)
- Determine origin of the breach and counter-measures to prevent any future access to personal data
- Implement counter-measures
- Resume service
- Disseminate client-specific reports to each affected client[1] by email
- We will post a message on our blog with a summary of the incident
# Notify us
In addition, should any parties wish to bring any information to our attention regarding a breach or suspected breach of our data they can contact us via our support channel
Note: in most cases it will not be possible to notify affected users directly as Spike does not have direct contact details for these users. Spike will rely on the client (as responsible party) to communicate this information to affected users on our behalf. ↩︎