Even when precautions are taken, sometimes something goes wrong. What matters then is to act quickly and tell the right person.
What a personal data breach is
It is any security incident that causes the accidental or unlawful destruction, loss or alteration of personal data, or its unauthorised disclosure or access (article 4.12 of the GDPR). It can be accidental or deliberate. Examples:
- an email with customer data sent to the wrong person
- the loss or theft of a laptop, a phone or a USB stick
- a cyber attack or a virus that encrypts files (ransomware)
- a paper folder left behind on a train
- an account used by someone who should not have it, for example after phishing
- the accidental deletion of a database with no backup
You do not have to wait until you are sure of the harm. Doubt is enough to report it.
What you must do
- Report it immediately to the person or department your company has indicated (IT, management, the data protection officer).
- Say what you know: what happened, when, what data is involved and how many people it may affect.
- Do what you can to limit the damage, if you can do so without risk: change a password, disconnect a device from the network, ask the wrong recipient to delete the message.
- Do not delete evidence and do not try to fix it quietly on your own.
- Do not hide it. A problem reported in time can usually be brought under control. A hidden problem grows.
The GDPR deadlines
- To the supervisory authority (AEPD). The controller must notify the breach without undue delay and, where feasible, not later than 72 hours after having become aware of it (article 33.1). Notification is not needed if the breach is unlikely to result in a risk to people's rights and freedoms. If the deadline is not met, the reasons for the delay must be given.
- To the people affected. When the breach is likely to result in a high risk to their rights and freedoms, the controller communicates it to them without undue delay, in clear language (article 34). An example is a leak of bank or health data.
- From the processor to the controller. If it is a processor that suffers the breach, it must notify the controller without undue delay (article 33.2).
The 72 hours are counted from when the company becomes aware, and that includes the moment you find out. If you take three days to report it, the deadline has practically run out. A late report can cost the company a fine.
The internal record
As well as notifying, the controller must document all breaches, including those that are not notified: the facts, their effects and the measures taken (article 33.5). That way it can show the AEPD how it acted. The LOPDGDD treats failing to notify the authority of a personal data breach as a serious infringement (article 73.r).
What is notified to the AEPD
The notification describes the nature of the breach, the categories and approximate number of people and records affected, the contact details of the data protection officer or another person, the likely consequences and the measures taken. It is submitted through the AEPD's electronic office (aepd.es).
Remember: whoever spots the problem does not have to solve it or judge it. Your task is to report it the same day.