A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Article 4(12) GDPR). It does not have to be a hacker attack.
Examples from work
- an e-mail with personal data sent to the wrong recipient
- a lost or stolen laptop, phone or USB drive
- an employee who looks into other people's records without authorisation
- phishing after which an attacker gained access to an account
- documents with personal data thrown away or lost
- a ransomware attack in which data is encrypted and unavailable
- data published on a website or social network by mistake
A breach also includes loss of availability of data, not only a leak.
What the controller must do
- Report the breach to the Office for Personal Data Protection without undue delay and, where feasible, within 72 hours of becoming aware of it (Article 33). The exception is where the breach is unlikely to result in a risk to the rights and freedoms of people. A late notification must be justified.
- If the breach is likely to result in a high risk, also notify the affected people, in clear language and without undue delay (Article 34). The duty does not apply, for example, where the data was effectively encrypted.
- Document every breach, including one that is not reported (Article 33(5)).
A processor reports a breach to the controller without undue delay (Article 33(2)). There is a form for notifying the Office at uoou.gov.cz.
What the notification contains
Under Article 33(3), the notification to the Office describes in particular:
- the nature of the breach, the categories and approximate number of people and records concerned
- the name and contact details of the data protection officer or another contact point
- the likely consequences of the breach
- the measures the controller has taken or proposes to take to deal with the breach and reduce its effects
If the controller does not have all the information at once, it can provide it in phases (Article 33(4)). That is why nobody waits until everything is clear. Your notes on when, what and to whom it happened are the basis for the notification.
Time is short
The 72-hour deadline is short. If you discover a breach and say nothing, the company loses time and may miss the notification, and then has to justify the delay to the Office. So report everything immediately.
What to do if you discover a problem
- Do not panic and do not sweep anything under the carpet. Reporting early matters more than who made the mistake.
- Inform your supervisor, the data protection officer or the person named in the internal rules immediately. Do not say "later" or "it will sort itself out".
- If you can, prevent further damage: disconnect the device, call the recipient of the wrong e-mail and ask them to delete it, change the password.
- Write down what happened: when, what, to whom and which data was affected.
- Do not delete evidence and do not contact the affected people on your own initiative unless someone has told you to.
- Follow the instructions. The controller decides on notifying the Office.
Risk assessment
The controller assesses whether a risk is likely and how high it is. It considers the type of data (health, documents, finance), the number of people, how easy identification is, the consequences and whether the data was encrypted. One e-mail with a timetable sent to a colleague by mistake carries practically no risk. A list of diagnoses sent to a stranger carries a high one.
What to remember
- A personal data breach is not only a hacker attack. A wrongly sent e-mail is enough.
- The controller reports to the Office within 72 hours of becoming aware of the breach.
- You must tell it immediately so that you do not shorten its deadline.
- Every breach is documented.