Breach Notification System

Overview

The Breach Notification System provides a complete solution for detecting, managing, and reporting data breaches in compliance with the Nigeria Data Protection Act 2023 (NDPA). It includes components for breach reporting, risk assessment, notification management, and regulatory reporting.

v3 Quick Start

v3 introduces zero-config presets, compound components for custom layouts, and a StorageAdapter pattern so you can plug in any persistence backend without touching component internals.

// Drop in a fully-working breach report form with NDPA defaults
import { NDPRBreachReport } from '@tantainnovative/ndpr-toolkit/presets';

<NDPRBreachReport />

import { Breach } from '@tantainnovative/ndpr-toolkit/breach';

<Breach.Provider categories={categories}>
  <Breach.ReportForm />
</Breach.Provider>

import { useBreach } from '@tantainnovative/ndpr-toolkit/hooks';
import { apiAdapter } from '@tantainnovative/ndpr-toolkit/adapters';

// The adapter prop accepts any StorageAdapter for custom persistence
// (server-side DB, REST API, localStorage, etc.)
const breach = useBreach({ categories, adapter: apiAdapter('/api/breaches') });

Installation

Install the NDPR Toolkit package which includes the Breach Notification components:

pnpm add @tantainnovative/ndpr-toolkit

Components

The Breach Notification system includes several components that work together:

import { BreachReportForm } from '@tantainnovative/ndpr-toolkit';

<BreachReportForm
  onSubmit={handleSubmitBreachReport}
  categories={[
    { id: 'unauthorized-access', label: 'Unauthorized Access' },
    { id: 'data-loss', label: 'Data Loss' },
    { id: 'system-compromise', label: 'System Compromise' },
    { id: 'phishing', label: 'Phishing Attack' },
    { id: 'other', label: 'Other' }
  ]}
/>

import { BreachRiskAssessment } from '@tantainnovative/ndpr-toolkit';

<BreachRiskAssessment
  breachData={breachData}
  onComplete={handleRiskAssessmentComplete}
/>

import { BreachNotificationManager } from '@tantainnovative/ndpr-toolkit';

<BreachNotificationManager
  breaches={breaches}
  onUpdateStatus={handleUpdateStatus}
  onSendNotification={handleSendNotification}
/>

import { RegulatoryReportGenerator } from '@tantainnovative/ndpr-toolkit';

<RegulatoryReportGenerator
  breachData={breachData}
  organizationInfo={organizationInfo}
  onGenerate={handleGenerateReport}
/>

Usage

Here's a complete example of how to implement the Breach Notification system in your application:

import { useState, useEffect } from 'react';
import {
  BreachReportForm,
  BreachRiskAssessment,
  BreachNotificationManager,
  RegulatoryReportGenerator
} from '@tantainnovative/ndpr-toolkit';

const breachCategories = [
  { id: 'unauthorized-access', label: 'Unauthorized Access' },
  { id: 'data-loss', label: 'Data Loss' },
  { id: 'system-compromise', label: 'System Compromise' },
  { id: 'phishing', label: 'Phishing Attack' },
  { id: 'other', label: 'Other' }
];

const organizationInfo = {
  name: 'Example Company Ltd.',
  address: '123 Main Street, Lagos, Nigeria',
  dpoName: 'John Doe',
  dpoEmail: 'dpo@example.com',
  dpoPhone: '+234 123 456 7890'
};

function BreachReportingPage() {
  const [submitted, setSubmitted] = useState(false);
  const [currentBreach, setCurrentBreach] = useState(null);

  const handleSubmitBreachReport = (breachData) => {
    const newBreach = {
      ...breachData,
      id: `breach-${Date.now()}`,
      status: 'reported',
      reportedAt: new Date()
    };
    setCurrentBreach(newBreach);
    setSubmitted(true);
  };

  return (
    <div>
      {!submitted ? (
        <BreachReportForm onSubmit={handleSubmitBreachReport} categories={breachCategories} />
      ) : (
        <div>
          <p>Breach reference: <strong>{currentBreach.id}</strong></p>
          <BreachRiskAssessment
            breachData={currentBreach}
            onComplete={(assessment) => setCurrentBreach({ ...currentBreach, riskAssessment: assessment })}
          />
        </div>
      )}
    </div>
  );
}

function BreachManagementDashboard() {
  const [breaches, setBreaches] = useState([]);
  const [selectedBreach, setSelectedBreach] = useState(null);

  return (
    <div>
      <BreachNotificationManager
        breaches={breaches}
        onUpdateStatus={(id, status) => console.log(id, status)}
        onSendNotification={(id, notification) => console.log(id, notification)}
        onSelectBreach={setSelectedBreach}
      />
      {selectedBreach?.riskAssessment?.requiresNdpcNotification && (
        <RegulatoryReportGenerator
          breachData={selectedBreach}
          organizationInfo={organizationInfo}
          onGenerate={(report) => console.log(report)}
        />
      )}
    </div>
  );
}

Props

BreachReportForm Props

BreachReport Type

type BreachReport = {
  id?: string;
  title: string;
  category: string;
  description: string;
  discoveredAt: Date;
  reportedBy: {
    name: string;
    email: string;
    department: string;
  };
  affectedSystems: string[];
  affectedDataTypes: string[];
  estimatedImpact: string;
  initialActions: string;
  status?: string;
  reportedAt?: Date;
  updatedAt?: Date;
};

72-Hour Notification Timeline

The NDPA requires organizations to notify the NDPC of data breaches within 72 hours of becoming aware of the breach. Here's a recommended timeline for handling breaches:

API Reference

BreachReport Interface

export interface BreachReport {
  id: string;
  title: string;
  description: string;
  category: string;
  discoveredAt: number;
  occurredAt?: number;
  reportedAt: number;
  reporter: {
    name: string;
    email: string;
    department: string;
    phone?: string;
  };
  affectedSystems: string[];
  dataTypes: string[];
  estimatedAffectedSubjects?: number;
  status: 'ongoing' | 'contained' | 'resolved';
}

RiskAssessment Interface

export interface RiskAssessment {
  id: string;
  breachId: string;
  assessedAt: number;
  assessor: {
    name: string;
    role: string;
    email: string;
  };
  confidentialityImpact: number;
  integrityImpact: number;
  availabilityImpact: number;
  harmLikelihood: number;
  harmSeverity: number;
  overallRiskScore: number;
  riskLevel: 'low' | 'medium' | 'high' | 'critical';
  risksToRightsAndFreedoms: boolean;
}

NotificationRequirement Interface

export interface NotificationRequirement {
  ndpcNotificationRequired: boolean;
  ndpcNotificationDeadline: number;
  dataSubjectNotificationRequired: boolean;
  justification: string;
}

useBreach Hook

import { useBreach } from '@tantainnovative/ndpr-toolkit';

const {
  breaches,
  submitBreachReport,
  updateBreachReport,
  performRiskAssessment,
  determineNotificationRequirements,
  generateRegulatoryReport,
  getBreachById,
} = useBreach();

// Submit a new breach report
const newBreachReport = submitBreachReport({
  title: 'Unauthorized Database Access',
  description: 'An unauthorized IP address accessed our customer database.',
  category: 'unauthorized-access',
  discoveredAt: Date.now(),
  reporter: {
    name: 'John Doe',
    email: 'john@example.com',
    department: 'IT Security'
  },
  affectedSystems: ['customer-database'],
  dataTypes: ['personal-information', 'contact-details'],
  estimatedAffectedSubjects: 500,
  status: 'contained'
});

// Perform a risk assessment
const riskAssessment = performRiskAssessment({
  breachId: newBreachReport.id,
  assessor: {
    name: 'Jane Smith',
    role: 'Data Protection Officer',
    email: 'jane@example.com'
  },
  confidentialityImpact: 4,
  integrityImpact: 3,
  availabilityImpact: 2,
  harmLikelihood: 3,
  harmSeverity: 4
});

// Determine notification requirements
const requirements = determineNotificationRequirements({
  breachId: newBreachReport.id,
  riskAssessmentId: riskAssessment.id
});

// Generate a regulatory report for the NDPC
if (requirements.ndpcNotificationRequired) {
  const report = generateRegulatoryReport({
    breachId: newBreachReport.id,
    riskAssessmentId: riskAssessment.id
  });
}

Best Practices

• Breach Response Plan: Develop a comprehensive breach response plan that includes roles, responsibilities, and procedures.
• Regular Training: Conduct regular training for staff on breach identification, reporting, and response procedures.
• Documentation: Maintain detailed documentation of all breach-related activities, including containment, investigation, and notification.
• Testing: Regularly test your breach response procedures through tabletop exercises or simulations.
• Post-Breach Review: Conduct a thorough review after each breach to identify lessons learned and improve your response procedures.

Need Help?

If you have questions about implementing the Breach Notification system or need assistance with NDPA compliance, check out these resources: