An information security incident may involve an event that compromises, or reasonably threatens to compromise, the confidentiality, integrity, or availability of information or systems.

Examples may include:

• Unauthorized access to client datasets or project accounts.
• Loss or theft of devices containing confidential materials.
• Accidental disclosure of restricted documents or recordings.
• Exposure or compromise of passwords and access credentials.
• Unauthorized sharing of transcripts, translations, or annotation files.
• Uploading confidential project materials to an unapproved platform.
• Malware, phishing, or other suspicious activity affecting project information.
• Accidental deletion, corruption, or alteration of important files.
• Unauthorized publication or reuse of protected client materials.
• Suspected personal data breaches involving identifiable individuals.

Not every technical problem constitutes a personal data breach. Incidents should be assessed according to their nature, circumstances, and potential impact.

Staff members, freelance professionals, project coordinators, and other authorized contributors should report suspected security incidents promptly after becoming aware of them.

Reports should be directed to the relevant project lead or authorized agency representative.

Individuals should not delay reporting merely because the full circumstances are unknown or the incident has not yet been confirmed.

Early reporting helps support appropriate assessment, containment, and protection of affected information.

Following an incident report, the agency should assess the available information to understand the nature and potential seriousness of the concern.

Relevant considerations may include:

• The type of information or system affected.
• Whether personal or confidential information is involved.
• The sensitivity and approximate volume of affected materials.
• The nature of any unauthorized access or disclosure.
• Whether the incident is ongoing.
• The possible consequences for clients or affected individuals.
• Relevant contractual and legal obligations.
• Whether immediate protective action is required.

The assessment should be proportionate to the available evidence and updated as additional information becomes known.

Where reasonably practicable and appropriate, steps should be taken to prevent further unauthorized access, disclosure, loss, or damage.

Depending on the circumstances, these measures may include:

• Restricting or suspending affected account access.
• Securing compromised credentials.
• Reviewing relevant sharing permissions.
• Limiting access to affected project materials.
• Preventing further unauthorized distribution.
• Coordinating with the relevant client or service provider.
• Preserving information necessary for investigation.
• Taking other proportionate protective measures.

Actions should be coordinated where necessary to avoid interfering with contractual requirements or relevant evidence.

Information relevant to understanding a security incident should be preserved where appropriate and lawful.

Such information may include relevant communications, access records, file-sharing details, incident reports, or other available documentation.

Evidence should be handled responsibly and accessed only by authorized individuals with a legitimate need.

Incident investigation must not become a justification for unnecessary collection or disclosure of personal information.

Where appropriate, Shufeyr Freelance Agency should review the circumstances of a suspected or confirmed incident to identify its likely cause, affected information, potential consequences, and available corrective measures.

The investigation may involve consultation with relevant project coordinators, authorized contributors, clients, or service providers.

Any conclusions should be based on the available evidence rather than unsupported assumptions.

Where the incident involves personal information, applicable data protection requirements must be considered.

Where a security incident affects client-owned materials or systems, the agency should assess whether notification is required under the relevant agreement or applicable law.

Client-specific incident reporting instructions and contractual deadlines must be followed where applicable.

Notifications should provide information that is accurate and reasonably available at the time, including relevant known circumstances and measures taken, where appropriate.

Further updates may be provided as additional facts are established or as required by the applicable agreement.

Where an incident involves personal information, Shufeyr Freelance Agency should assess its responsibilities under applicable data protection laws, including Kenya's Data Protection Act, 2019, where relevant.

Notification obligations may depend on the agency's role, the nature of the breach, the risks involved, and the applicable legal requirements.

Where legally required, appropriate notifications must be made to the relevant data controller, supervisory authority, or affected individuals within the applicable legal timeframes.

The agency should not assume that every security incident requires the same notification procedure.

Freelance linguists, translators, transcription specialists, annotators, AI evaluators, reviewers, and other contributors are expected to report suspected incidents affecting materials accessed through authorized assignments.

Contributors must not conceal incidents, independently disclose confidential details to unrelated parties, or attempt unauthorized investigations.

Where an incident occurs, the relevant individual should cooperate with appropriate assessment and corrective measures in accordance with applicable agreements and law.

Where an incident involves an authorized external platform, communication service, or technology provider, the agency should assess the relevant contractual responsibilities and available reporting procedures.

Coordination with the provider may be necessary to clarify the incident, secure affected information, or support appropriate recovery measures.

The involvement of an external provider does not automatically eliminate the agency's applicable legal or contractual responsibilities.

Following containment and assessment, appropriate recovery or corrective measures should be considered.

Depending on the incident, these may include:

• Restoring authorized access or affected information.
• Correcting inappropriate permissions.
• Updating relevant working procedures.
• Clarifying project security instructions.
• Reviewing account or device security requirements.
• Addressing identified weaknesses.
• Providing appropriate guidance to affected contributors.
• Confirming required contractual or legal follow-up actions.

Recovery measures should reflect the seriousness of the incident and the relevant operational circumstances.

Where appropriate, the agency should maintain relevant incident documentation to support accountability, contractual compliance, and future improvements.

Such records may include the incident description, known timeline, affected information, assessment findings, actions taken, and applicable notification decisions.

Incident records may themselves contain sensitive information and should be handled according to appropriate confidentiality and retention requirements.

Records should not be retained longer than justified by applicable legal, contractual, or legitimate operational needs.

Suspected unauthorized access, exposed credentials, lost project files, accidental disclosure, or other information security concerns should be reported promptly through an official agency channel.

For incidents involving confidential documents, restricted datasets, or sensitive personal information, email is the preferred initial contact channel so that an appropriate method of exchanging supporting details can be arranged.

Reports should not include passwords, authentication codes, or unnecessary copies of compromised confidential materials.

Shufeyr Freelance Agency recognizes that security incident management includes learning from relevant incidents and improving professional information-handling practices.

Where appropriate, incident findings may inform updates to access requirements, freelancer instructions, approved tools, file-handling procedures, and confidentiality arrangements.

Any improvement measures should reflect the agency's operational circumstances, client obligations, and applicable legal requirements.

Incident response activities must be conducted in accordance with applicable laws, relevant contractual agreements, and the legitimate rights of affected individuals and organizations.

Nothing in this policy is intended to limit lawful reporting, regulatory cooperation, or legal rights that cannot be excluded.