What do I do after a data breach at my business?

Question

Our small company has had a data breach; an employee emailed a customer list to the wrong person. I am panicking about what we are legally required to do. What are the steps?

Joshua Cook · Accepted Answer

Take a breath, then work through it methodically, because the law expects a prompt and reasonable response rather than perfection. First, contain the incident as far as you can, for example by trying to recall the email and asking the wrong recipient to delete it and confirm they have done so. Then assess what personal data was involved and how much risk it poses to the people affected. Under the UK data protection rules you must record the breach internally in all cases, and if the breach is likely to result in a risk to people's rights and freedoms you must report it to the Information Commissioner's Office, generally without undue delay and within 72 hours of becoming aware of it. If the risk to individuals is high, you also have to tell the affected people themselves so they can protect themselves. Document your decisions and reasoning throughout.

Grace Carter · Answer

After the immediate response, review how it happened and put measures in place to reduce the chance of it recurring, such as training or technical controls, because regulators look favourably on organisations that learn from incidents. Not every breach has to be reported, but you must be able to justify the decision either way, which is why recording your risk assessment matters. If you are unsure whether it crosses the reporting threshold, the ICO publishes guidance and a self assessment, and taking advice quickly is wise given the 72-hour window. General information only.

What do I do after a data breach at my business?

2 Answers

0 Comments

Related legal questions