Even with good measures, mistakes happen. What sets a good company apart is the speed with which it detects the problem and acts. On this subject the GDPR sets rules and tight deadlines.
What a personal data breach is
A personal data breach is a breach of security leading, accidentally or unlawfully, to the destruction, loss, alteration, unauthorised disclosure of, or access to personal data (Article 4(12) of the GDPR). It covers three types of problem:
- confidentiality: someone without permission sees or receives the data;
- integrity: the data is altered without authorisation;
- availability: the data is lost or becomes inaccessible.
Examples:
- an email with customer data sent to the wrong recipient;
- a work laptop or phone that is lost or stolen;
- a cyber attack or ransomware that encrypts the files;
- a document with personal data left in a public place;
- an email account taken over after phishing;
- a colleague who looks at files without needing to.
What the worker must do
- Report immediately to the line manager, the DPO or whoever the company names. Do not wait until you are sure.
- Say what you know: what happened, when, what data is involved. Do not erase or change evidence.
- Follow the instructions to limit the damage, for example change the password or disconnect the device from the network.
- Do not hide the incident, not even to "protect" a colleague. Hiding it delays the response and makes the damage worse.
Lei n.º 58/2019 (Article 11) gives the DPO the task of raising awareness of the importance of detecting incidents in time and of informing the person responsible for security without delay.
What the employer must do
- Notify the CNPD without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to people's rights and freedoms (Article 33(1)). If the deadline is not met, the notification must state the reasons for the delay.
- The notification describes the nature of the breach, the categories and approximate number of data subjects and records, the DPO's contact details, the likely consequences and the measures taken (paragraph 3).
- Communicate it to the data subjects when the breach is likely to result in a high risk to them, without undue delay and in clear language (Article 34).
- Record all breaches, even those that do not need to be notified, with the facts, the effects and the measures (Article 33(5)).
- A processor that becomes aware of a breach informs the controller without undue delay (Article 33(2)).
Failing to meet the duties in Articles 33 and 34 is a serious administrative offence (Article 38(1), points (j) and (k), of Lei n.º 58/2019).
Why speed matters
A warning within minutes makes it possible to recall an email, block an account or change access before the damage spreads. A warning after days may already have missed the 72-hour deadline. The company wants to know, even about a small mistake.
Practical examples
- Sent a file to the wrong customer? Tell someone now. It may be possible to ask the recipient to delete it and confirm.
- Lost your work phone? Tell someone now. The company may be able to block or wipe the device remotely.
- Clicked a suspicious link? Tell someone now, disconnect from the network if told to, and do not use the computer any more.
Summary: a personal data breach is any improper loss, access or disclosure. Warning straight away is the worker's duty. Notifying the CNPD within 72 hours is the employer's job.