How quickly are customers notified of a security incident?
Incidents affecting Customer personal data are notified without undue delay after awareness.
Under the OPTOVERA Data Processing Agreement, SOBEREYE notifies the Customer without undue delay after becoming aware of a Security Incident affecting Controller Personal Data. SOBEREYE provides the reasonably available information the Customer needs to assess risk and meet its own notification duties. Information may be supplied in phases as it becomes available, so notification does not wait for the investigation to be completed.
The Customer determines whether notification to a regulator, Data Subjects, or another party is required, except where mandatory law directly assigns that duty to SOBEREYE. Notification is not an admission of liability. A Country Supplement may set a specific deadline for a given jurisdiction.
For security events that do not affect Controller Personal Data, communication depends on the affected service, customer impact, the applicable agreement, and legal requirements.