Retention and incident management — draft

For transaction traces, comparisons, reports, access logs, support records and commercial documents, identify purpose, legal basis, owner, period and disposal method separately. Active versus historical storage does not determine legal retention. Avoid indefinite retention or a single period for all categories.

Integrity controls do not extinguish rectification or erasure rights. Assess each request against legal basis, mandatory retention and dispute needs. Define appropriate correction/addenda, access restriction or authorised disposal procedures rather than silently editing sealed content. Do not assume unverified automatic legal-hold or cryptographic-erasure features.

1. Identify the incident and contain affected access or systems.
2. Preserve relevant evidence under controlled access.
3. Assess data, individuals, scope and potential consequences.
4. Inform the controller and designated teams.
5. Complete applicable authority/individual notifications and follow-up.
6. Record corrective action, root cause and retest results.

KVKK Board Decision 2019/10 describes notification to the Board without delay and within 72 hours of awareness, with separate requirements for affected individuals. GDPR distinguishes risk-based authority notification, generally within 72 hours, from a processor’s duty to notify its controller without undue delay. The regimes have different conditions and exceptions. KVKK breach notification decision; GDPR.

Use info@sigillum.cloud for initial contact. Agree incident procedures, authorised contacts, support scope and secure file exchange in the contract schedules. This draft does not promise an unspecified response time or a 24/7 security operations centre.