Personal Data Breach Incident Response Plan

Effective Date: 10 September 2026

Maintained by: Head of CyberSecurity & Infrastructure

1. Purpose and Scope

This Incident Response Plan outlines the procedures Horizon follows in the event of a personal data breach, as required under applicable data protection laws, including the LGPD (Brazil), GDPR (EU), and similar frameworks. It applies to all employees, contractors, and systems involved in handling personal data.

2. Definitions

Personal Data Breach: A security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data.
Data Subject: Any individual whose personal data is processed by Horizon.
Supervisory Authority: A regulatory body with jurisdiction over data protection compliance (e.g., ANPD in Brazil, EU Supervisory Authorities under GDPR).

3. Roles and Responsibilities

Role	Responsibility
CTO	Overall ownership of the plan, initiates critical response
Incident Response Lead	Coordinates technical investigation and mitigation
Legal/Privacy Officer/Compliance	Leads compliance, notifications, and reporting
Communications Lead	Manages internal/external communications to stakeholders
DevOps/Infrastructure Team	Provides logs, access control validation, and forensic support

4. Incident Response Stages

1. Identification

Monitor systems continuously using automated tools and alerting mechanisms (AWS CloudWatch, Dash0, audit logs, etc.).
Employees and third parties must report suspected breaches immediately to [email protected].

Personal Data Breach Incident Response Plan

1. Purpose and Scope

2. Definitions

3. Roles and Responsibilities

4. Incident Response Stages

1. Identification

2. Containment