Personal data breach response

Severity classification

• Critical — Confirmed exfiltration of notice images, driver PII, or cross-tenant access. Immediate customer notification.
• High — Confirmed unauthorised access to a single tenant without exfiltration evidence. Customer notification within 24 hours.
• Medium — Suspected access blocked before confirmation, or exposure, or exposure of non-sensitive metadata only.
• Low — Near-miss events or misconfiguration caught before exploitation.

Fleet customers (B2B)

When we process driver data on your instructions, we notify your organisation as controller without undue delay and within 48 hours of becoming aware of a breach affecting your tenant. You are responsible for ICO and driver communication where you are controller.

ICO registration

Hypernest registers with the UK Information Commissioner's Office as a data controller. Registration details are published on the privacy notice footer once the certificate is issued. See also our ROPA summary.

Post-incident review

Every medium-or-above incident receives a post-incident review within 14 days documenting root cause, corrective actions, and preventive controls. Summary reports are available to fleet customers on request under confidentiality terms.

Individual subscribers

Direct EnforceIQ Labs subscribers receive notification when their personal data is affected, alongside guidance on protective steps such as password reset and monitoring for phishing attempts.

Report a concern

If you believe there has been unauthorised access to your EnforceIQ Labs data, contact [email protected] with subject line "Security incident". For production tenants, include your organisation name and approximate time of discovery.