Last updated: 29 May 2026

Personal Data Breach Process

This English version is provided for convenience. If legal interpretation differs, the German version applies unless mandatory law provides otherwise.

1. Objective

This process governs handling of possible personal data breaches, such as unauthorized access, loss, disclosure, alteration, encryption by attackers, misdirected sending or faulty tenant separation.

2. Reporting and initial assessment

Suspicious events must be reported internally without undue delay to the management of Proximo Systems Dreessen & Haensch GbR. The initial assessment clarifies whether personal data may be affected, which systems are affected, whether the incident is ongoing and which immediate measures are required.

3. Immediate measures

Depending on the incident, access may be blocked, tokens rotated, systems isolated, logs preserved, faulty functions disabled, backups protected, passwords reset or external service providers involved. Measures are documented.

4. Investigation

The investigation determines cause, time, affected users, workspaces, categories of personal data, scope of disclosure, possible consequences and countermeasures already taken. Relevant evidence and log data are preserved.

5. Risk assessment

It is assessed whether there is a risk or high risk to the rights and freedoms of natural persons. The nature and sensitivity of the data, quantity of data, identifiability, protective measures such as encryption, likelihood of misuse and possible harm are considered.

6. Customer notification

Where clutr acts as processor, the affected customer is informed without undue delay so the customer can fulfill its obligations as controller. The information includes, where available, nature of the incident, affected data, affected persons, likely consequences and measures taken.

7. Notification to supervisory authorities

Where Proximo Systems Dreessen & Haensch GbR acts as controller and a notifiable personal data breach exists, notification to the competent supervisory authority is made where possible within 72 hours after becoming aware. Delays are explained.

8. Notification of affected persons

If there is likely to be a high risk to affected persons, they are informed without undue delay in accordance with the GDPR unless a statutory exception applies. The information is provided clearly and understandably.

9. Closure and follow-up

After containment and investigation, causes are remedied, protective measures improved, affected customers informed, documentation completed and lessons for technology, processes and contracts derived.

10. Documentation

Every data protection or security incident is documented, even where there is no notification obligation. Documentation includes timeline, responsible persons, decisions, risk assessment, communication, measures and evidence.