Data Breach Response Plan

Effective Date: October 25, 2026 • Supervising Authority: Nigeria Data Protection Commission (NDPC) • Version: 2026.1 (Pilot Ready)

STATUTORY INCIDENT REPORTING MANDATE:
Pursuant to Section 40 of the Nigeria Data Protection Act (NDPA) 2023 and the CBN Cybersecurity Guidelines, Collekt Technologies Ltd enforces a strict operational protocol for detecting, containing, investigating, documenting, and reporting security incidents. A confirmed breach likely to result in a risk to Data Subjects must be reported to the Nigeria Data Protection Commission (NDPC) within seventy-two (72) hours of identification.

Incident Plan Table of Contents

1. Objectives & Incident Definition 2. Incident Response Team (IRT) Roles 3. Severity Classification Matrix 4. Phase 1: Detection & Triage (0-2h) 5. Phase 2: Containment & Isolation (2-12h) 6. Phase 3: Statutory 72-Hour Reporting 7. Data Subject Notification Protocol 8. Phase 4: Root Cause & Remediation 9. Tabletop Exercises & Continuous Testing

1. Objectives & Breach Definition

A "Personal Data Breach" refers to any security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or otherwise processed by Collekt or its sub-processors.

The primary objectives of this Plan are:

Ensure immediate containment to halt ongoing unauthorized access.
Preserve cryptographic and digital evidence compliant with Section 84 of the Evidence Act 2011.
Fulfill mandatory 72-hour notification obligations to the Nigeria Data Protection Commission (NDPC).
Protect user funds, escrow custody, and sensitive identity credentials.

2. Incident Response Team (IRT) Structure

The Collekt Incident Response Team (IRT) is activated immediately upon a suspected breach:

IRT Role	Primary Function	Key Responsibilities
Incident Commander (CTO / Head of Engineering)	Technical Command	Directs technical containment, isolation of servers, key rotation, and forensic backup.
Data Protection Officer (DPO)	Regulatory & Compliance Lead	Assesses severity, leads statutory filings with NDPC, and drafts data subject notices.
Forensic Security Engineer	Evidence & Threat Analysis	Analyzes WORM audit logs, reconstructs breach vector, ensures forensic chain of custody.
Legal Counsel	Statutory Compliance	Advises on Evidence Act 2011 admissibility, CBN reporting, and contractual liabilities.
Corporate Communications Lead	Stakeholder Disclosures	Manages transparent communication to affected pilot users, media, and partners.

3. Severity Classification Matrix

Level 1 — Low: Isolated anomaly; no data exfiltration; mitigated by existing automated controls (e.g., bot rate-limit block).
Level 2 — Medium: Unauthorized attempt resulting in localized service disruption; zero access to financial or KYC databases.
Level 3 — High: Potential compromise of non-sensitive user profile records or partial document leakage; no financial fund loss.
Level 4 — Critical: Confirmed unauthorized access to sensitive KYC data (NINs), escrow payment rails, or administrative privilege escalation. Mandates immediate IRT activation and NDPC filing.

4. Phase 1: Detection & Triage (0 – 2 Hours)

Incidents are identified via automated telemetry, anomalous API spike alarms, webhook signature failures, or vulnerability disclosure to compliance@collektng.com:

The on-call engineer assesses the anomaly and activates the Incident Commander.
The IRT convenes within sixty (60) minutes to assign severity and establish an immutable incident incident log.

5. Phase 2: Containment & Forensic Eradication (2 – 12 Hours)

Automated Circuit Breaker: If financial or escrow endpoints are targeted, the Incident Commander triggers the Escrow Circuit Breaker, temporarily freezing outbound NUBAN withdrawals.
Credential Revocation: Immediate rotation of Supabase service keys, payment gateway API secrets, and Netlify deploy tokens.
Session Termination: Invalidation of all active JWT session tokens via CollektSessionManager, forcing global re-authentication.
Forensic Preservation: Immediate write-blocking and cryptographic hash generation of PostgreSQL audit ledgers, preserving evidence under Section 84 of the Evidence Act 2011.

6. Phase 3: Statutory 72-Hour Reporting to the NDPC

Pursuant to Section 40(1) of the NDPA 2023, if an assessment indicates a likely risk to the rights and freedoms of Data Subjects, Collekt must notify the Nigeria Data Protection Commission (NDPC) within seventy-two (72) hours.

NDPC Statutory Breach Notification Dossier:
1. Nature of the personal data breach, including categories and approximate number of Data Subjects.
2. Contact details of the Collekt Compliance Office (compliance@collektng.com).
3. Likely consequences and assessed risks of the breach.
4. Measures taken or proposed to contain, mitigate, and remediate the incident.

7. Data Subject Notification Protocol

Pursuant to Section 40(3) of the NDPA, where a breach presents a high risk to users (such as financial credential exposure or identity theft risk):

Affected users are notified directly via registered email and prominent in-app notification without undue delay.
Notifications provide clear, non-technical explanations of the breach, specific data elements involved, steps Collekt has taken, and recommended user safeguards (e.g. resetting transaction PINs).

8. Phase 4: Root Cause Analysis (RCA) & Remediation

Within fourteen (14) calendar days of breach closure, the IRT submits a formal Root Cause Analysis (RCA) and Corrective Action Plan (CAPA) to the Board of Directors and the NDPC, covering code patches, enhanced RLS rules, and employee refresher training.

9. Tabletop Exercises & Continuous Testing

The IRT conducts mandatory semi-annual simulated breach tabletop drills (covering escrow bypass, KYC data leakage, and DDoS extortion scenarios) to ensure operational readiness.