The Article 29 Working Party Guidelines contain some scenarios of what is and what isn't reportable. You should therefore establish the facts and assess the likelihood and severity of risks in deciding whether to report. Identify theft, fraud, financial loss and damage to reputation are other risks to rights and freedoms that could result. The inappropriate disclosure of sensitive or confidential information could be a reportable if it would have a negative impact on someone's sense of privacy. This depends on what was in the data and how it might be used to damage them, as well as the scale of the breach. Such a risk would be one where the people involved could suffer adverse effects as a result of the breach. Not all breaches need to be reported to the ICO, but if the breach is likely to involve a 'risk to people's rights and freedoms', it must be ( Article 33). If you fail to notify a reportable breach it can result in a significant fine. the likelihood and severity of impact on the people affectedĪfter a breach has been escalated within your organisation, you must decide if you need to report it to the Information Commissioner's Office.the number of people likely to be affected.Where a breach occurs, the organisation should first establish: It's important that you foster a culture of openness in your organisation to help meet your responsibility under the law. It would be much worse if a breach is not reported for fear of sanction. Often, this might be difficult for a member of staff to admit if they feel that they're at fault. Let them know that they should report a suspected breach to an identified member of staff (possibly a Data Protection Officer) who handles the rest of the procedure. It is therefore crucial that your organisation has a suitable data protection policy in place, and that all of your staff, including any volunteers, are aware of their responsibilities.Įven when a crime has been committed against you it is your responsibility to follow the necessary procedures, as the breach involves personal data under your control.Īll staff must know how to recognise a breach and that they have a duty to make the organisation aware. They could also occur through carelessness and a lack of procedure or guidance. Some of these incidents may happen through human error and honest mistakes. Information for small and medium sized organisations.The National Cyber Security Centre (NCSC) provides lots of useful and practical information on protection your organisation from cyber threats.

Copy me that data breach