Even with good habits, things go wrong. Then it is a matter of reacting quickly. The rules are in Articles 33 and 34 of the General Data Protection Regulation.
What is a breach?
A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data (Article 4(12)). It can affect three things:
- Confidentiality: Unauthorised people gain access. Example: an email with payroll lists is sent to the wrong recipient.
- Integrity: Information is changed without permission or by mistake.
- Availability: Information is lost or cannot be used. Example: ransomware encrypts the files, or a backup is missing.
More examples: a lost laptop or mobile phone holding information, a hacker attack, papers in an open container, a spreadsheet shared with too many people, an employee who looks in the system without a work-related need, and a misdirected letter that ends up with someone else.
Your responsibility: say so straight away
As an employee you must:
- Report the incident immediately to the contact person or system that the company has designated. Do not wait to see whether it turns out to be serious.
- Say what you know: what happened, when, and what information and how many people it may concern.
- Try to limit the damage if you can, for example by asking a wrong recipient to delete the email. Do so only by agreement, though, and do not delete any evidence yourself.
- Not hide the mistake or correct it on the quiet.
It is the company, not you, that assesses whether the incident must be notified.
The company's duties
- Notification to Datatilsynet (Article 33(1)): When the controller becomes aware of a breach, it must notify Datatilsynet without undue delay and, where feasible, within 72 hours. The exception is where the breach is unlikely to result in a risk to people's rights and freedoms. Notification is made digitally through Datatilsynet's form on virk.dk. If it is made later than 72 hours, the reason for the delay must be given. Information can be provided in phases.
- Communication to the people affected (Article 34): If the breach is likely to result in a high risk to the people, they must also be told without undue delay, in clear and plain language.
- Processors must notify the controller without undue delay (Article 33(2)).
- Documentation (Article 33(5)): The company must keep a record of all breaches, including those that are not notified, with the facts, effects and measures taken. Datatilsynet can ask to see it.
The 72-hour deadline is counted from the time the company becomes aware of the breach, and it includes weekends. That is one of the most important reasons to report quickly inside the company: every hour you wait eats into the company's time.
After the breach
The company should learn from the incident: what went wrong, and how do we prevent it next time? A mistake that is reported openly is an opportunity to improve routines.
Remember: 72 hours. Your quick report is the first link in the company's deadline.