| | APRIL 2020ENTERPRISE SECURITY8IN MY OPINIONBy Sarah Laws, Data Protection/Information Management, London Borough of CamdenEncouraging a Culture of Internal Data Breach ReportingAs we all know, the General Data Protection Regulation makes reporting personal data breaches to the Supervisory Authority compulsory in certain cases. A personal data breach is a breach of security that leads to the unlawful or accidental destruction, loss, alternation of, unauthorised access to or disclosure of personal data. Where this breach is likely to cause a risk to data subjects' rights and freedom, the breach needs to be reported to the Supervisory Authority (The Information Commissioner's Office in the UK). This means if the incident is likely to cause reputational damage, financial loss or damage, enable identity theft, or lead to discrimination for example, it needs to be reported. If the breach is "likely to result in a high risk" to "the rights and freedom" of data subjects, then all those affected need to be informed, although there are some circumstances where notifying all those affected will not be required. The reporting must be carried out as soon as possible and within 72 hours of becoming aware of the incident.There is the possibility of hefty fines for breaches of GDPR, up to 20 m or four percent of worldwide turnover. Not only this, the publicity and poor PR than can accompany a breach can lead to reputational damage, which can be hard to recover from and have wide ranging negative consequences. This makes having an internal data breach reporting and investigation plan essential. Each organisation needs to keep comprehensive records of breaches, the risk assessments they have carried out of those breaches, and the mitigations undertaken to contain or neutralise the breach. Most breaches within an organisation are likely to be minor and not meet the threshold for reporting to the Supervisory Authority. Organisations still need to keep clear records to justify why a decision not to report was made.
< Page 7 | Page 9 >