Data Breaches
Data breaches are more often than not a result of human error – mistakes do happen, the important thing is how you as a business responds to it.
At ReGDPR we help businesses prepare for, respond to and recover from data breaches.
We also offer training to your staff or your own GDPR in house team on how to reduce the risk of a Breach occurring, how to recognise one if it does take place & helping you to put in to place the correct policies and procedures.
A data breach isn’t just a hack or cyberattack. In Ireland and in the UK a breach is any incident where personal data is lost, accessed, disclosed, or altered without proper authorisation this more often than not iss done by accident but can occasionally been done with malicious intent.
Common situations that constitute as a breach include:
Sending personal data to the wrong recipient.
Using CC instead of BCC on an email list and disclosing personal email addresses to third parties.
Losing an unencrypted laptop or USB stick.
Emailing attachments containing sensitive information.
Misconfigured cloud storage or databases.
Employee misuse or insider threats.
Ransomware or phishing attacks.
If personal data is compromised, you may have a legal duty to report it within 72 hours.
If you require emergency assistance ReGDPR Is here to help.
We will firstly assess if the incident qualifies as a notifiable breach and then guide you through ICO or DPC reporting requirements.
We already have draft notification letters to data subjects (if needed) which we will tailor to the situation.
Helping to contain the breach and mitigate risk immediately is our main priority.
Once the breach is mitigated it is important to identify how the breach happened and what data was affected.
We would always recommend an audit of all internal processes and policies so that we can take corrective action and create future prevention strategies.
As the fall out from the Breach dies down its important to think about future planning. Eileen of ReGDPR can conduct Data Breach Response Training as well as fundamental training for your staff on their GDPR obligations.
