Incident Response
IR-05Notify affected customers when their data or systems were exposed
How Leela would run itEvent-driven · each incident exposing customer data, typically within 5 to 10 business days of confirmation
From the policy libraryThe requirement
Customers are notified of any incident involving unauthorized access to their identity documents, account details, or transaction records, or a compromise of their systems through the Company. The Compliance Officer decides the need and timing with outside counsel; notice goes out as soon as practical after containment and root cause analysis, typically within five to ten business days of confirmation, coordinated with regulatory notices and the sponsor bank. The notice states what happened, when, what the Company did, what the customer should do, and whom to contact, in language counsel has approved.
- Applies
- Tell Leela about your company to see whether this applies.
- Status
- Setup needed
Tell Leela how you handle it today, or hand it over: see what’s next.
The work
Record the notification decision and its basis, draft the notice with the required content, obtain counsel’s approval, align timing with the bank and any regulatory notice, send it, and keep the evidence.
What Leela keepsThe evidence this obligation leaves, as the work happens
Listed from the policy libraryContents
- 01Notification decisionRequired or not, basis, counsel consulted, date
- 02Customer noticeApproved text, recipients, and send date
Evidence
Notification decision
Incident Response §6
2
of 2 records
The work and the records come from this obligation in the policy library.