A personal data breach (Article 4(12)) is a security incident that leads to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to personal data. It can happen to anyone.
Examples
- An e-mail with customer details is sent to the wrong person.
- A laptop, phone or USB stick with personal data goes missing.
- Someone tricks an employee into giving out a password, and an unauthorised person logs in.
- An employee looks at patient records or registers when this is not part of the job.
- A file with personal data is put openly on the internet.
- A ransomware attack encrypts data so that it cannot be reached.
- Papers with personal data are thrown in the ordinary rubbish.
When data is lost or becomes unavailable, that is also a breach, not only when someone reads it without permission.
Your first task: report at once
You do not have to decide how serious it is. Your task is to tell your manager, IT security or the function your employer has appointed quickly. Every hour counts, because the employer has a short deadline.
- Report even when you think you made the mistake yourself. It is better to report unnecessarily.
- Do not delete evidence. Do not try to "tidy up" in secret.
- Write down what happened, when and which data is affected.
- Follow the instructions you are given. Do not ask the recipients of a misdirected message to pass it on.
The employer's obligations
Notification to IMY
Under Article 33, the controller must notify a breach to IMY without undue delay and, where feasible, within 72 hours of becoming aware of it. An exception applies if the breach is unlikely to result in a risk to people's rights and freedoms. The notification is made at imy.se. If it is made later than 72 hours, the reasons for the delay must be stated.
The 72 hours are counted in continuous hours, so weekends and public holidays count too. The clock starts when the organisation becomes aware, and sometimes that is when an employee noticed the breach. That is why your quick report is decisive.
The notification must describe, among other things, what has happened, which data and how many people are affected, the likely consequences and what measures the organisation has taken. If not everything is known yet, the information may be given in stages.
Informing the data subjects
If the breach is likely to result in a high risk to people's rights and freedoms, the people concerned must also be informed without undue delay (Article 34). This applies, for example, when account details, health data or personal identity numbers have fallen into the wrong hands.
Documentation
All breaches must be documented, including those that are not notified to IMY (Article 33(5)). IMY can ask to see the documentation.
Processors
A processor must inform the controller without undue delay after becoming aware of a breach (Article 33(2)). The controller's 72 hours then begin.
After the breach
The organisation learns from what happened: how could it happen, and what needs to change? The aim is not to point out someone to blame, but to prevent it from happening again.