Duty to Notify American Express
As a Service Provider, if you know or suspect that Cardmember information has been accessed or used without authorisation you must, as detailed fully in the Data Security Operating Policy:

1. Notify American Express immediately
2. Work with American Express and auditors to conduct a thorough audit of the incident
3. Provide any and all information, and follow all instructions provided by American Express with regard to the incident

1. By notifying American Express immediately if you know or suspect your data has been compromised
2. By ensuring that you are in full compliance with the American Express Data Security Operating Policy
3. If the data incident was not caused by the wrongful conduct of you or one of your employees or agents