Breach notification decision
Decision tool Data protectionDecide who must be told about a personal data breach, and by when.
Has a security incident led to personal data being lost, altered, disclosed, accessed or made unavailable?
Not a personal data breach
Log the incident in your security records. If personal data turns out to be affected, start again: the clock runs from awareness.
Basis: UK GDPR Art 4(12)
Are you a provider of a public electronic communications service?
PECR notification as well
Notify the Information Commission under PECR within 72 hours of becoming aware of the essential facts, and subscribers where the breach is likely to adversely affect them. Then also work through the UK GDPR route.
Basis: PECR reg 5A
PECR profile PECR personal data breach (communications providers) procedure
Is the breach unlikely to result in a risk to people's rights and freedoms?
Record only
Record the breach and your reasoning in the breach register. No notification needed.
Basis: UK GDPR Art 33(1) and (5)
Breach: should the Information Commission be told? checklist
Is the risk to people likely to be high?
Notify the Information Commission within 72 hours
Notify without undue delay and, where feasible, within 72 hours of awareness. Individuals need not be told.
Basis: UK GDPR Art 33
Personal data breach notification procedure Breach: should the Information Commission be told? checklist
Notify the regulator and the people affected
Regulator within 72 hours of awareness; the people affected without undue delay, in clear language, unless an Art 34(3) exception applies. Preserve all records: destroying them after a subject access request is an offence (DPA 2018 s.173).
Basis: UK GDPR Arts 33 and 34; DPA 2018 s.173
Sources
- Primary UK GDPR (Regulation (EU) 2016/679 as it applies in the UK) legislation.gov.uk
- Primary Privacy and Electronic Communications (EC Directive) Regulations 2003 legislation.gov.uk
- Primary PECR regulation 5A legislation.gov.uk