Information Security and Data Breach Response Policy

Purpose

Clients trust us with sensitive information. This policy sets out how NEO keeps information secure and how we respond to a breach, consistent with our duty of confidentiality and Canada's private-sector privacy law (PIPEDA).

Who it applies to

Every licensee, employee and contractor, on every device used for the firm's work.

How we keep information secure

• Encryption: information is encrypted in transit and at rest on the systems that hold it.
• Access: everyone signs in with their own account, and sees only what their role allows. Access ends the day someone stops working with us.
• Documents: files are kept in private storage with no public address, and shared with clients through the secure client portal.
• Devices: devices used for firm work are locked with a password or biometrics and kept up to date.
• Email and payments: we never change payment instructions by email alone. Clients are told to confirm any request to send money by calling us on a number they already have.
• Providers: we use established hosting and software providers with independently audited security controls.
• Backups: firm records are backed up regularly.

If there is a breach

1. Contain it: stop the loss, for example by revoking access or recalling a message.
2. Assess it: what information, whose, and the risk of harm.
3. Notify: where there is a real risk of significant harm, we notify the affected people and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and tell clients promptly in every case that affects their matter.
4. Record it: we keep a record of every breach of security safeguards, as the law requires, whether or not it had to be reported.
5. Learn from it: we fix the cause and update this policy if needed.

Review

This policy is reviewed at least once a year, and whenever the Law Society's By-Laws or rules change. The principal approves every change.

Questions

Email info@neolegalservices.com, call 647-200-3526 or toll-free 888-519-2435, or write to us at Unit 236, 1099 Kingston Road, Pickering, Ontario L1V 1B5.