What a data breach really is
"Data breach" brings to mind a stolen customer database put up for sale. The GDPR uses a broader definition: a personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Article 4(12)).
In practice it covers many situations that nobody in the company would call a breach:
- ransomware encrypts the ERP holding customer records: nobody has copied anything, but the data is no longer available;
- a salesperson leaves an unencrypted laptop on a train;
- HR sends a department's payslips to the wrong recipient;
- a colleague looks at data that their role should not give them access to.
What the GDPR requires, article by article
There are four obligations, and they do not all apply at the same time.
| Obligation | When | Reference |
|---|---|---|
| Document the breach | Always, even when it does not need to be notified: the facts, its effects and the remedial action taken | Article 33(5) |
| Notify the supervisory authority (Garante) | Without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms | Article 33(1) |
| Inform the data subjects | When the breach is likely to result in a high risk to people, subject to the exceptions provided for | Article 34 |
| Notify the controller | This falls to the supplier processing the data on your behalf (the processor), without undue delay after becoming aware of it | Article 33(2) |
Three details matter more than they seem. The 72 hours run from when the controller became aware of the breach, not from when it happened. If not all the information is available straight away, it can be provided in phases. And if the notification is made after 72 hours, the reasons for the delay must be given. In Italy the supervisory authority is the Garante per la protezione dei dati personali (the Italian Data Protection Authority), which provides an online notification procedure on its website.
Among other exceptions, the data subjects do not need to be informed if the data had been made unintelligible to anyone not authorised to access it, for example through encryption: a lost laptop with an encrypted disk is a very different case from one without.
The same incident may also have to be notified to CSIRT Italia (Italy's national computer security incident response team), with its own deadlines: a separate obligation, to be handled in parallel. It is covered in the guide on NIS2 for SMEs.
The first 72 hours, step by step
- Contain: block the compromised account, isolate the affected systems, ask the unintended recipient to delete the email. If the attack is still in progress, follow the sequence in the guide on the first hours of a ransomware attack.
- Establish what happened: which systems, which data, how many people, since when. Health or financial data is a different matter from a list of business email addresses.
- Assess the risk to people, not to the company: fraud, identity theft, confidential information ending up in the wrong hands.
- Decide whether to notify and whom to inform: unless the risk to people is unlikely, you notify the Garante; if it is high, you also inform the data subjects. The controller decides, after consulting the DPO if one has been appointed.
- Document the facts, assessments and decisions in the register, including the reasons when you decide not to notify.
- the nature of the breach, including the categories and approximate number of data subjects and of records concerned;
- the name and contact details of the DPO or another contact point;
- the likely consequences of the breach;
- the measures taken or proposed to address the breach and mitigate its effects.
“Approximate” is the word to remember: an exact count is not required.
Who needs to be at the table
- The controller, meaning the company, acting through its legal representative: it decides and is accountable.
- The DPO, if there is one: gives an opinion and is the contact point named in the notification.
- The in-house IT team or IT supplier: reconstructs the technical facts and secures the systems.
- The lawyer: contracts, external communication, any criminal complaints.
- The suppliers that process the data: the cloud ERP provider, the payroll consultant. If the breach is in their systems, the information will come from them.
The most common mistakes
- Thinking there is no breach without theft. Data encrypted by ransomware or deleted by mistake is a loss of availability.
- Waiting until you know everything. The 72 hours run out while you look for certainty; that is why phased notification exists.
- Not recording what you do not notify. Every breach goes in the register.
- Finding out from the supplier weeks later. Without a contractual requirement for prompt notice, the supplier sets the timing.
Prepare before it happens
- there is a written procedure setting out who does what when a breach is suspected;
- each role has a named person, a deputy and a phone number that can be reached at weekends;
- there is a breach register template, ready to fill in;
- I know where the most sensitive personal data is held and which suppliers process it;
- contracts with suppliers that process data on my behalf require prompt notice of any breach;
- laptops and removable media are encrypted.
In short
Under the GDPR, ransomware that makes data unavailable or an email sent to the wrong address is also a breach. Every breach must be recorded; unless the risk to people is unlikely, it is notified to the Garante within 72 hours of becoming aware of it, in phases if necessary, and if the risk is high the data subjects are informed. The procedure, roles and supplier contracts are prepared in advance.