Suspected incidents are investigated promptly to determine scope and impact.
If personal data is impacted, relevant stakeholders are notified in accordance with legal or contractual requirements.
Corrective actions are implemented to mitigate impact and reduce future risk.