Data Breach Procedure

Last updated: 9 July 2026

This page explains how Qfile B.V. handles a (suspected) data breach in OurDigitalContract: how to report it to us and which steps we take. For the division of roles between controller and processor, please see our data processing agreement.

What is a data breach?

A data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Examples: a lost or stolen device with access to data, a misaddressed email containing personal data, a hacked account, or documents made public unintentionally.

Reporting a suspected breach

Do you suspect a data breach, or notice something that looks like one? Report it to us as soon as possible, preferably within 24 hours, at support@ourdigitalcontract.com. Please provide as much information as possible: what you saw, when, which data appears to be involved and which people may be affected. Do not take any action yourself that could erase evidence.

Our internal steps

• Detection and logging: we record the report immediately and assign an owner to it.
• Containment: we take measures as quickly as possible to stop the breach and limit further damage (for example revoking access, ending sessions or deactivating an account).
• Assessing the risk: we investigate what happened, which data and which people are involved and what the risk to the data subjects is.
• Recording in the breach register: we note the facts, the consequences and the measures taken, even where a notification to the supervisory authority turns out not to be required.
• Evaluation: after handling, we review what we can improve to prevent a recurrence.

Notifying the supervisory authority

If a data breach poses a risk to the rights and freedoms of data subjects, the controller must notify the supervisory authority within 72 hours of becoming aware of it. In the Netherlands this is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Where we are ourselves the controller (for example for the data of our own account holders), we make that notification.

Notifying data subjects

If the data breach poses a high risk to the data subjects, they are informed without undue delay, in clear language and with advice on what they can do themselves. Where we act as processor, the information to data subjects is provided through the controller.

Our role as processor

For the data that customers process in OurDigitalContract, the customer is the controller and we are the processor. If a data breach becomes known to us, we notify the relevant controller(s) without undue delay, with the information needed, so that they can meet the statutory 72-hour deadline. See also our data processing agreement for this.

Contact

To report a data breach or for questions about this procedure: Qfile B.V., support@ourdigitalcontract.com.