# WYG Student Data Breach Notification Procedure

**Status:** Pilot incident procedure; tabletop and contact test required  
**Updated:** August 23, 2026  
**Report immediately:** wygplaybookapp@gmail.com

## 1. Trigger and priority

A suspected incident is any event that may compromise the security, confidentiality, or integrity of WYG School Data. Reports involving student data, account takeover, cross-program access, leaked credentials, private uploads, or altered score history receive highest priority.

## 2. Intake and containment

The incident lead records the reporter, time, systems, program, facts, and evidence source; assigns severity; preserves relevant logs; revokes exposed sessions/tokens; limits affected access; and contains the vulnerable component. Student data should not be copied into ordinary email when a safer channel is available.

## 3. Assessment and determination

WYG determines what happened, whether protected/covered information was acquired or accessed without authorization, affected School/program, student count, data categories, timing, likely consequences, provider involvement, ongoing risk, and whether law enforcement or counsel should be engaged. Conclusions and uncertainty are documented.

## 4. School notice

After determining a student-data breach occurred, WYG will notify the School without unreasonable delay. The proposed contract target is within 72 hours of determination, and the notice will not exceed the maximum period applicable to WYG under Illinois SOPPA. The signed agreement controls.

Initial notice will include, to the extent known: incident and determination date; occurrence date/range; affected systems, School, and estimated students; categories of information; containment and remediation; likely risk; steps the School or users should take; provider/law-enforcement involvement; WYG incident contact; and the next update time. Missing facts will be clearly identified and updated rather than delaying notice.

## 5. Ongoing coordination

WYG sends material updates on an agreed cadence, preserves evidence, supports the School's investigation, supplies facts needed for parent/regulator notices, and does not make a School-identifying public statement without coordination unless law requires it. The School controls its notices and records duties; WYG remains responsible for notices legally assigned to WYG.

## 6. Parent-notice support

WYG will provide the School known dates, compromised information, contact details, affected-student count, and mitigation facts needed for the School's Illinois notice. The School and counsel determine its deadline and required consumer-reporting/FTC information. WYG will not contact parents directly unless the School authorizes it or law requires it.

## 7. Remediation and closure

WYG removes the cause, rotates affected secrets, patches and validates controls, checks for recurrence or cross-program exposure, and restores service only when risk is acceptable. A closure report documents root cause, timeline, affected data, decisions, notice, corrective actions, responsible owners, and due dates.

## 8. Post-incident review

Within 10 business days after containment, or another agreed period, WYG holds a lessons-learned review and tracks corrective actions to completion. Contractual cost allocation, insurance notice, credit monitoring, legal fees, audit expenses, and regulatory costs are handled under the signed DPA.

## 9. Pre-pilot verification

Before student use, WYG and the School test the privacy/security contacts, escalation path, template notice, evidence preservation, emergency access revocation, provider escalation, and a tabletop scenario. Failure of the contact test or an unresolved high-severity issue blocks launch.