What is a personal data breach, and when must you report it?

What it is

A breach is broader than a cyber attack: an email to the wrong person, a lost laptop, a ransomware attack that blocks access, or staff snooping all count. Every breach must be recorded, whether or not it is reported. Processors must tell the controller without undue delay. Communications providers have a parallel duty under PECR.

When you must act

• Report to the regulator without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk. UK GDPR Art 33(1)
• Tell affected people without undue delay where the breach is likely to result in a high risk to them. Art 34(1)
• Record every breach, its effects and the remedial action, whether reported or not. Art 33(5)
• As a processor, notify the controller without undue delay. Art 33(2)

When you need not tell individuals

• The data was protected so it is unintelligible, such as by encryption with the key safe. Art 34(3)(a)
• Measures taken since mean the high risk is no longer likely. Art 34(3)(b)
• It would involve disproportionate effort, in which case a public communication is required instead. Art 34(3)(c)

Who is responsible

The controller. A processor reports to its controller, not to the regulator.

What it involves

1. Contain the breach and recover data.
2. Assess the risk to individuals: what data, how many people, what harm.
3. Decide whether to report, and record the reasoning.
4. Report within 72 hours, in phases if facts are still emerging.
5. Tell individuals where the risk is high, with advice on protecting themselves.
6. Fix the cause and record lessons learned.

Timing

72 hours from becoming aware, including weekends and bank holidays.

If it goes wrong

Regulatory

Failing to notify breaches Arts 33 and 34 (standard tier, up to £8.7 million or 2%). The security failure behind the breach usually breaches Art 5(1)(f) and Art 32, and the largest UK penalties have been for that.

Criminal

No offence for failing to notify. A person who deliberately took or disclosed the data may have committed the s.170 offence.

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168. Group claims after breaches are common.