How are customers notified in the event of security incidents?
amaise follows internationally recognized reporting obligations and the legal requirements of the respective jurisdiction in the event of security incidents:
GDPR Art. 33/34 (EU): Report to the competent supervisory authority within 72 hours. Notify affected individuals if there is a high risk.
Swiss nDSG Art. 24: Report to the FDPIC and notify affected individuals as soon as possible in case of high-risk data breaches.
US regulations: Compliance with applicable State Breach Notification Laws and industry-specific requirements.
HIPAA (US health data): 60 days to notify affected individuals and HHS; State Breach Notification Laws may have shorter deadlines of 30-45 days.
Professional secrecy: Assess implications for data subject to special confidentiality obligations (e.g., attorney-client privilege, medical confidentiality).
Communication channels:
Direct customer communication for affected clients
Status page for public updates
Incident details include: what happened, scope, impact, and measures taken
For S1 and S2 incidents, confirmation occurs within 15 minutes (business hours) and communication within 15-30 minutes.
Customer notification as the client:
amaise notifies the customer as the client (controller) within 24 hours after identifying a security incident affecting their data. This enables the customer to meet their own regulatory reporting obligations on time.