Data Breach Notification

Once an organisation becomes aware of a breach, a clock starts. Under the GDPR the regulator must be told without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to put people at risk. If the risk to people is high, they must be told too, in plain language, with advice on protecting themselves. The notice usually covers what happened, what data was involved, the likely consequences and the steps taken. Other laws set different deadlines and triggers, and some sector rules, such as those for banks, add their own. Processors must alert the controller they work for. Organisations also keep an internal log of every breach, reported or not. It is separate from cyber incident reporting, which is aimed at security or sector supervisors. Missing the deadline adds a second failing on top of the original breach.

A clinic discovers that an email with 800 patient letters went to the wrong distribution list. Within a day, the privacy officer assesses the risk as high because the letters hold diagnoses. The regulator is notified inside the deadline, each patient receives a letter explaining what happened, and the incident is added to the breach log.