Data Security and Breach Handling
Security is a process, breaches are a timeline
Security questions test whether you know the controls and, more often, the breach response sequence. Learn the timeline cold.
Appropriate technical and organisational measures. Technical: encryption, access controls, authentication, logging, backups, pseudonymisation. Organisational: policies, training, role-based access, vendor management, physical security. Trap: candidates assume one control (e.g., a password) is sufficient; the standard is appropriate to the risk, considering the nature of data, likelihood and severity of harm.
What counts as a personal data breach. Any security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Trap: a breach is not only a hack - a misdirected email, lost laptop, or accidental deletion qualifies.
Response sequence. (1) Detect and contain; (2) assess risk to individuals; (3) notify the supervisory authority without undue delay and, where required, within a short statutory deadline (commonly 72 hours of becoming aware, where the regime sets one); (4) notify affected individuals if there is a high risk to them; (5) document the incident, remediation, and lessons learned. Trap: notification to the regulator is not automatic for every incident - it depends on risk; but internal documentation is required regardless.
Content of a notification: nature of the breach, categories and approximate numbers affected, likely consequences, and measures taken or proposed.
Rule of thumb: Contain → Assess risk → Notify (regulator if required, individuals if high risk) → Document. When unsure whether to notify, the safe exam answer is to assess risk and document the decision.
Worked example: An employee emails a spreadsheet of client records to the wrong external address. This is unauthorised disclosure. Contain (request deletion, recall), assess (how sensitive, how many people, likely harm), notify the regulator if the risk threshold is met, inform individuals if high risk, and record the incident and fix.