Cloud CRM, Offshore Support and a Data Breach

The firm must assess the arrangement against the Personal Data (Privacy) Ordinance. Data was collected for onboarding and investment suitability, so its use in the CRM must be consistent with the original purpose and the firm's personal information collection statement. The privacy policy's broad reference to transfers "within the group and to service providers" may not be sufficiently specific to satisfy the openness requirement, particularly where offshore subcontractors can access sensitive data. The firm remains accountable for the data even when a vendor processes it. It should have conducted vendor due diligence, imposed contractual security and confidentiality obligations, restricted access on a need-to-know basis, and required notification of breaches.

Outsourcing raises additional SFC concerns. The firm should have assessed whether the arrangement is material and whether it needed to notify the SFC before implementation. The contract's lack of audit rights, encryption standards and breach-notification timeline is a control gap. Subcontracting to India should have been approved and risk-assessed, with data localisation and cross-border access considered. The firm should also assess whether the cloud configuration error was a cybersecurity incident requiring notification. The SFC expects licensed corporations to have robust outsourcing governance, exit plans and incident-response arrangements. The client access request must be handled under the data access and correction provisions, with a response within 40 days and a correction process where the data is inaccurate.

The firm should activate its incident-response plan, contain the exposure, preserve logs and evidence, and determine the root cause. It should confirm whether the bucket is now secured, whether the data was accessed or exfiltrated, and which individuals and data fields are affected. It should assess the risk of identity theft, financial loss and distress, and decide whether to notify affected clients promptly. Notification should be clear, practical and explain what the firm is doing and what clients should do. The firm should also consider notifying the Privacy Commissioner for Personal Data, the SFC, the police if there is evidence of criminal access, and any other regulators as required.

The firm should not wait for a full forensic investigation before making a preliminary risk assessment. It should document the timeline, decisions and notifications. It should assess whether the incident is a material breach requiring SFC notification; even if not mandatory, the SFC expects prompt notification of significant cyber incidents and control failures. The firm should appoint a senior responsible person, engage external forensic support if needed, and consider whether the affected clients should be offered credit monitoring or other mitigation. The client access and correction request should be handled separately but consistently, and the firm should not use the breach as a reason to delay the response.

The firm should renegotiate or replace the vendor contract to include specific security controls, encryption at rest and in transit, access management, subcontractor approval, audit and inspection rights, incident notification within a defined period, data-return and deletion obligations, and cooperation with regulatory inquiries. It should require the vendor to disclose the identity and location of subcontractors and to flow down equivalent obligations. The firm should maintain a register of outsourcing arrangements, classify them by materiality and assess concentration risk.

Governance remediation should include a board-approved outsourcing policy, due diligence before onboarding, periodic vendor reviews, a data inventory and data-flow mapping, and a cross-border transfer assessment. The firm should review its privacy policy and personal information collection statement to ensure they are accurate and specific. It should implement data minimisation, role-based access, logging and monitoring, and regular penetration testing. Staff should be trained on data handling and incident escalation. The firm should also test its incident-response plan and clarify who is responsible for regulatory notifications. Finally, it should consider whether the breach reveals a need to notify the SFC of a material outsourcing or cyber incident and should document its conclusion.