Data breaches are a common occurrence in all parts of the world today. Although it's not what we desire to happen, things do occur. Additionally, the EU GDPR protects data breaches involving the personal information of EU residents. It also means that within 72 hours of discovering the breach, information about the personal data breach may need to be given to the Data Protection Authority. In addition, breaches involving personal data may result in significant fines and harm to one's reputation. Let's examine how to respond to a breach of personal data under the EU GDPR. So, the Data Protection Officer (DPO) should be notified by the personnel, which is often the security incident management team. The Data Protection Authority will accordingly be notified by the controller's DPO where there is a high risk to the privacy and rights of data subjects. If data subjects' rights and freedoms are at great risk, the controller's DPO may alert them. This should be carried out in collaboration with the organization's public relations staff. As per the terms of the agreement, the controller must be notified by the processor's Data Protection Officer. Under these circumstances, the controller must be notified of any breaches involving personal data. In light of this, the following procedures should be followed in handling the personal data breach:
1) Inform the Data Protection Officer: The first and most important thing to do when a personal data breach is discovered is to notify and involve the DPO in the company.
2) Assess scope and impact: Determine the extent and consequences of the breach of personal data; i.e.:
- Verify whether there was a breach of personal data
- Determine the number of people whose personal information may have been breached
- Ascertain which categories of personal information may have been compromised
- Enumerate the security precautions that were already taken to stop the data breach.
The goal of this stage should be to give the DPO enough information to notify the Data Protection Authority of any breaches of personal data, as the controller is required to report such breaches to the authorities within 72 hours.
3) Notify the relevant parties: If the organization is the controller of personal data, the DPO shall notify the Data Protection Authority. The controller's DPO shall also notify the data subjects if there is a significant risk to their rights and freedoms. If the organization handles personal data, the DPO is obligated to inform the designated representative as per the terms of the controller-controller agreement.
The communication should contain the DPO's contact information, information about the breach, its expected impact, the actions that have already been taken and those that are being taken to lessen its effects. It's also critical to note that appropriate steps are being taken to lessen the damage and that more impact is being researched, if necessary. Also, everything should be mentioned in the EU GDPR Documents because it will be important in the hereafter as well.
4) Deep dive, contain and notify: The incident team must continue exploring deeper into the following two tracks concurrently as the DPO notifies the appropriate authorities:
- Taking all appropriate action to lower the risk and prevent additional unauthorized access
- Maintaining the process of fine-tuning the first approximation of the quantity of compromised data subjects and the categories of compromised personal information
The DPA or controller may be informed of developments as they become available. The controller's DPO would have to determine whether or not the data subjects additionally need to be informed if their freedoms and rights are severely affected. If appropriate, this communication should involve the company's public relations or communications team.
5) Review and monitor: After containing the breach of personal data, the organization should assess its current security protocols and investigate ways to make them stronger to stop future breaches of this kind. All such identified steps should be monitored to ensure that the measures are satisfactorily executed. Additionally, when you follow the following procedures, don't forget to maintain a data breach registration and track of your activities.
This is the reason why obtaining an EU GDPR certification will not necessarily result in data protection benefits, but it may help resolve a data breach in some circumstances. In light of this, Punyam.com will assist you in implementing the EU GDPR if you haven't already, with enhanced data protection and support from an expert consulting team.
Get the benefits of a professional accountant at a price you can afford, and powerful financial reporting software with zero learning curve.
