Beetl notifies the customer without undue delay after becoming aware of a Security Incident affecting Customer Personal Data. Proposed operational ceiling: initial notice within 24 hours of awareness, without waiting for a complete investigation. Where POPIA applies, Beetl notifies immediately when reasonable grounds exist to believe personal information has been accessed or acquired by an unauthorised person. The earlier or stricter applicable trigger prevails; 24 hours is not permission to delay an immediate notice. Unsuccessful generic scans without compromise are not alone Security Incidents.

Notice goes to the agreed incident email and escalation channel. Initial notice states known nature/time, affected systems/data/subjects, likely consequences, containment and the contact, clearly distinguishing unknown facts. Beetl provides material updates and, as a proposed target, at least daily updates during active containment unless otherwise agreed. It preserves relevant evidence securely, mitigates harm, cooperates with the customer's assessment/notifications and supplies a written closure summary. Neither party must speculate or disclose another tenant's data.

The customer ordinarily determines notices to individuals and authorities for its controller processing. Beetl does not notify in its name without authority unless law requires; Beetl's own controller/legal reporting remains unaffected. Beetl promptly informs the customer of legally binding disclosure requests unless prohibited, examines validity and challenges disproportionate requests where reasonably justified, discloses only what is required and records its response. Applicable mandatory transfer clauses control additional government-access obligations.