Personal data breach – what to do within 72 hours
Published: · Maksymilian Kruszewski
An e-mail sent to the wrong recipient, a lost laptop, a ransomware attack – each may be a personal data breach. The GDPR gives the controller 72 hours to notify the breach to the supervisory authority, in Poland the President of UODO.
Step 1. Establish what happened
A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. The 72 hours run from the moment the controller becomes aware of the breach, so internal reports should reach the responsible person without delay.
Step 2. Assess the risk
Assess which data and how many people are affected and what the consequences may be – e.g. identity theft, financial loss, loss of confidentiality. The assessment determines whether the breach must be notified and whether individuals must be informed.
Step 3. Notify the President of UODO
Notification is not required only where the breach is unlikely to result in a risk to the rights and freedoms of individuals. If not all information is available, it may be provided in phases. A late notification must include the reasons for the delay.
Step 4. Inform individuals and document the breach
- Where the breach is likely to result in a high risk, inform the data subjects in clear and plain language.
- Record the breach in the breach register – also if it was not notified.
- Take measures to mitigate the effects and prevent further breaches.
Let us discuss your matter
The first conversation is used to define the scope of the matter and the fee.