The Information Commissioner’s Office has a simple guide that explains what you need to do in the 72 hours following a data breach.
The seven step approach advocated is set out below:
Step one: Don’t panic
It’s understandable if you’re concerned about what happens next. But we’re here to help you understand what happened and to prevent it happening again.
Step two: Start the timer
By law, you've got to report a personal data breach to the ICO without undue delay (if it meets the threshold for reporting) and within 72 hours.
Step three: Find out what’s happened
Pull the facts together as quickly as possible.
Step four: Try to contain the breach
Your priority is to establish what has happened to the personal data affected. If you can recover the data, do so immediately. Also, you should do whatever you can to protect those who will be most impacted.
Step five: Assess the risk
You should now assess what you feel the risk of harm is to those affected, whether that’s your customers, members or service users.
Step six: If necessary, act to protect those affected
If possible, you should give specific and clear advice to people on the steps they can take to protect themselves, and what you’re willing to do to help them. If you don’t think there’s a high risk to the people involved, you don’t have to let them know about the incident.
Step seven: Submit your report (if needed)
If the breach is reportable, you can report it online.
The ICO have a help line you could call, 0303 123 1113, or view online advice at https://ico.org.uk/for-organisations/advice-for-small-organisations/72-hours-how-to-respond-to-a-personal-data-breach/.
by Admin
Share
STAY IN THE LOOP
Subscribe to our free newsletter.
A recent ruling has determined that targeting individuals online, even on a private group chat, can lead to a loss of employment. A Mr. Y was employed by the Royal Mail as a delivery driver with an
Companies and other organisations that are liable for Corporation Tax must ensure they register with HMRC at the correct time. Failing to register when required could result in missed filing
Businesses seeking investment through the Seed Enterprise Investment Scheme (SEIS) or Enterprise Investment Scheme (EIS) can benefit from obtaining advance assurance from HMRC before approaching
Employers providing loans to employees or directors need to ensure they correctly calculate any taxable benefit using HMRC’s official rate of interest. Where a loan is provided at no interest or at a