Data Breach Management and Incident Response
What to know
A personal data breach is a security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access to personal data. Know the three types: confidentiality, integrity, availability. Understand the notification test: notify the regulator without undue delay and generally within 72 hours of awareness where the breach is likely to result in a risk to rights and freedoms; notify affected individuals where there is a high risk. Maintain an internal breach register for all breaches, including those not notifiable. Know the content of a notification: nature, categories and approximate numbers, consequences, measures taken, and contact point.
Traps
- Confusing awareness with discovery by a third party or a later confirmation.
- Notifying only if data is sensitive; the test is risk, not category.
- Assuming a processor notifies the regulator; the processor notifies the controller, who decides.
- Forgetting the register for non-notifiable breaches.
- Treating ransomware without confirmed exfiltration as automatically non-notifiable; availability loss alone can be a breach.
Worked example
A laptop with unencrypted client records is stolen. Rule of thumb: contain, assess, decide, document. If records are identifiable and the device is unencrypted, risk is likely, so notify the regulator within 72 hours and consider informing clients. If the disk was strongly encrypted and keys were not compromised, risk is low: record internally and explain the reasoning.
Rule of thumb
Contain → assess risk to individuals → notify if required → document always → learn and remediate.