Personal Data Breaches Under GDPR: Assess, Notify, Recover
How to recognise a personal data breach, assess the risk to people, notify IMY within 72 hours and decide when to tell the people affected.
Utforska GDPR-guiden
Elva kapitel, vart och ett läsbart för sig. De flesta innehåller ett verktyg du kan använda medan du läser.
What counts as a personal data breach
A personal data breach is any security incident that leads to personal data being lost, destroyed, changed, disclosed or accessed without authority.
Confidentiality, integrity and availability breaches
Breaches fall into three types, and one incident can be more than one.
Assessing risk to individuals
The risk to the people affected decides whether you must notify IMY and the individuals.
Notifying IMY within 72 hours
Breaches likely to result in a risk to people must be reported to IMY within 72 hours of becoming aware.
When you must tell the people affected
If the breach is likely to result in a high risk, you must also inform the people affected without undue delay.
Processors, controllers and who reports
Controllers report to IMY. Processors must tell the controller without undue delay.
Documenting every breach in your register
All breaches must be documented, including those you decide not to report.
Common breach scenarios and how to handle them
Most breaches follow a few familiar patterns.
Breaches involving a ransomware attack
Ransomware is usually a personal data breach, especially when data was stolen.
Coordinating GDPR with NIS2 reporting
One incident can trigger both GDPR and NIS2 reports, to different authorities on different clocks.
Reducing the chance of the next breach
Each breach shows where controls or routines can improve.
Check Your Breach Readiness
Review your breach routine against GDPR Articles 33 and 34 and get the checklist in your inbox.
- Detection: Recognise a breach and start the clock. Kapitel 1 till 2
- Assessment: Assess the risk to the people affected. Kapitel 3
- Notification: Notify IMY within 72 hours. Kapitel 4 till 5
- Records: Log every breach, reported or not. Kapitel 7
Få din kostnadsfria GDPR-checklista
Levereras direkt till din inkorg.
Ingen skräppost. Datalagring inom EU. Avsluta när du vill.
Boka en säkerhetsgenomgång på 30 minuter.
Ingen säljpresentation.
Prata med en Sverigebaserad analytiker. Vi går igenom din säkerhetsnivå, kartlägger dina luckor och ger dig en tydlig bild av läget, på vanlig svenska.
Boka en kostnadsfri genomgång