A personal data breach is any security incident that leads to personal data being lost, destroyed, changed, disclosed or accessed without authority.
Breaches are not only hacks. A misdirected email, a lost laptop or an outage that makes data unavailable can all count.
Key points
- Breaches can be accidental or deliberate
- Unavailability can be a breach too
- Every breach must be documented
How this guide is organised
The guide has 11 chapters. Each one stands on its own, so you can read them in order or go straight to the topic you need.
- Confidentiality, integrity and availability breaches
- Assessing risk to individuals
- Notifying IMY within 72 hours
- When you must tell the people affected
- Processors, controllers and who reports
- Documenting every breach in your register
- Common breach scenarios and how to handle them
- Breaches involving a ransomware attack
- Coordinating GDPR with NIS2 reporting
- Reducing the chance of the next breach
Who this guide is for
It is written for IT and security leads, risk and compliance owners and the managers who sign off on the work. This guide follows the decisions in the order you will face them.