A breach (in the law called a "personal data breach") is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data (Article 4(12)). Both accidents and attacks count.
Examples
- an e-mail with payroll lists sent to the wrong recipient
- a laptop or phone with customer data is lost or stolen
- a phishing e-mail has given someone access to an e-mail account
- an employee has looked at patient records or customer cards without a work-related need
- a database is misconfigured and open on the internet
- ransomware has encrypted files with personal data
- paper folders have been thrown in ordinary rubbish
- a backup has been deleted and no one has a copy
Three types of breach:
- confidentiality: an unauthorised person gets access
- integrity: data has been changed without permission
- availability: data is lost or unavailable
Your duty: speak up immediately
As an employee you must report internally as soon as you discover or suspect a breach. Use the organisation's procedure, for example a breach report, IT support or the data protection officer. You are not to judge for yourself whether it is "big enough". That is for those in charge to decide. Do not delete evidence, do not try to hide the mistake and do not try to clean up alone.
Write down what you know: what happened, when, what data and who may be affected.
The organisation's duty to notify Datatilsynet
Under Article 33, the controller must notify the breach to Datatilsynet without undue delay and, where feasible, no later than 72 hours after becoming aware of it. This does not apply if the breach is unlikely to result in a risk to people's rights and freedoms. If the notification is made later than 72 hours, the delay must be explained.
The deadline is counted in hours, and it also runs at weekends and on public holidays. That is why every hour you spend before reporting counts.
The notification must, among other things, describe:
- the nature of the breach, and roughly how many people and records are affected
- a contact point for more information
- the likely consequences
- the measures taken or proposed
Information can be provided in phases if everything is not ready at once.
Processors
A processor that discovers a breach must notify the controller without undue delay (Article 33(2)). The 72-hour deadline applies to the controller.
Notifying those affected
If the breach is likely to result in a high risk to the people, for example financial fraud, identity theft or exposure of health data, the organisation must also notify them directly and in clear language (Article 34). This can be waived if the data was properly encrypted or the risk has been removed.
All breaches must be documented
Even those that are not reported to Datatilsynet must be documented internally (Article 33(5)): the facts, the effects and the measures. Datatilsynet can ask to see the documentation.
What happens afterwards?
The organisation assesses the risk, closes the gap, notifies if necessary and improves its procedures. The aim is learning, not finding scapegoats. Employees who report quickly and honestly are doing their job.