OurNews Incident Response

This page explains how OurNews handles and discloses a data incident. It’s written for a school’s IT reviewer, and it sits alongside our privacy policy (ournews.school/trust/privacy) and our Data Processing Terms (ournews.school/trust/data-processing), which it doesn’t override.

What counts as an incident

An incident is any event where information we hold (a school’s published content, a staff account, or a reveal-gate visitor record, see our privacy policy) is accessed, disclosed, altered or lost without authorisation.

The first 24 hours

When we become aware of a suspected incident, our first priority is to confirm what happened and contain it. A detailed internal runbook covers who assesses a suspected incident, against what test, and how the response is coordinated.

Telling your school

If we become aware of a breach affecting a school’s content, we’ll tell that school within 72 hours, with what we know at the time, and keep them updated as we learn more.

Your school’s own obligations

• We will help you meet the breach-notification obligations of your own jurisdiction. For example, Australia’s Notifiable Data Breaches scheme, or Articles 33 and 34 of the GDPR and UK GDPR, where they apply.
• For information where OurNews is the controller, we will notify the regulator directly.

What an incident could reach

OurNews is built to hold very little of what would typically make a breach serious: no student database, no parent database, no class lists, no reader credentials to steal. What a compromised region could expose is the content a school already chose to publish, plus a small, time-bounded reveal-gate log: up to 12 months of email addresses and 90 days of IP addresses.

Our internal runbook

We have a more detailed internal runbook that details how we will implement these commitments in the event of an incident. The runbook includes incident definitions and severity tiers, assessment against the Notifiable Data Breaches test, the notification tree, and the escalation path.

Contact

To report a suspected incident, or to ask about this page: hello@bolsta.education.