A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Article 4(12) GDPR). It does not take a cyber attack: a mistake is enough.
Three types of breach
- Confidentiality: the data reaches people who should not have had it. Example: an e-mail with health data sent to the wrong recipient.
- Integrity: the data is changed without authorisation or by mistake.
- Availability: the data is lost or no longer accessible. Example: a ransomware attack that encrypts the files, or a paper archive destroyed by flooding.
Examples
- An unprotected laptop or USB stick is lost or stolen.
- A file with customer data is attached by mistake to an external e-mail.
- A letter with health data is put in the wrong letterbox.
- A colleague uses someone else's credentials and looks at files that are not theirs.
- Someone clicks a phishing link and their account is taken over.
The 72 hours
The controller must notify the breach to the Garante within 72 hours of becoming aware of it, unless a risk to people's rights and freedoms is unlikely (Article 33 GDPR). After 72 hours the notification can still be made, but it must explain the delay. The Garante has an online procedure on its website.
The processor must inform the controller without undue delay after becoming aware of the breach.
If the risk to people is high, the controller must also warn the data subjects, in plain words, saying what happened and what they can do (Article 34). If the data was effectively encrypted, for example, the notice may not be needed.
The controller records every breach, even those not notified, in a breach register (Article 33(5)).
Why your report matters
The 72-hour deadline concerns the controller, but to meet it the company has to know straight away what happened. If you wait three days to say you sent a file to the wrong address, the time to react has already run out. Some breaches can still be put right if you act early: asking the recipient to delete the message, blocking an account, changing a password, disabling a device.
What to do if it happens
- Stop and do not try to "fix" it on your own by deleting messages or files: they may be needed to understand what happened.
- Tell the contact named by the company at once (IT department, privacy contact, DPO or your manager). If you do not know who that is, tell your manager: do not wait.
- Give the facts: what happened, when, which data, how many people, who may have seen it.
- Follow the company's instructions. Do not inform customers, journalists or social media on your own, and do not contact the authority: the assessment and any notification are for the controller.
- If you have already clicked a link or entered a password, change the password from a secure channel and say so.
A climate without fear
Someone who reports a mistake early should be listened to, not punished for speaking up. Companies that hide incidents run much greater risks. A breach that was not notified when it should have been can be fined by the Garante (Article 83(4) GDPR: fines of up to 10 million euros or 2 % of turnover).