How do you assess the risk of a data breach under GDPR?

1 Identify the breach

The first step is to identify the breach and determine its scope, scale, and impact. A data breach is defined by GDPR as any unauthorized or unlawful access, disclosure, alteration, loss, or destruction of personal data. This could be caused by malicious attacks, human error, technical failure, or natural disasters. You should document the breach and collect as much information as possible, such as the type and amount of data involved, the source and cause of the breach, the date and time of the incident, and the potential consequences for the data subjects and your organization.

3 Notify the authority

If you determine that the breach poses a risk to the rights and freedoms of the data subjects, you must notify the supervisory authority in the country where your organization is established or where the breach occurred within 72 hours of becoming aware of it. You should provide a detailed description of the breach, its impact and consequences, the measures taken or planned to address and prevent it, and the contact details of your data protection officer or other representative. You should also cooperate with the authority and follow its guidance and instructions.

4 Notify the data subjects

If you determine that the breach poses a high risk to the rights and freedoms of the data subjects, you must also notify them without undue delay. You should inform them of the nature and scope of the breach, the potential harm and implications, the steps taken or planned to remedy and prevent it, and the contact details of your data protection officer or other representative. You should also advise them of their rights and actions they can take to protect themselves, such as changing passwords, monitoring accounts, or contacting authorities. You should use clear and plain language and choose an appropriate communication channel, such as email, phone, or post.

5 Review and improve

The final step is to review and improve your data protection policies and practices to prevent or minimize the risk of future breaches. You should conduct a thorough analysis of the root causes and contributing factors of the breach, identify and implement any corrective and preventive measures, monitor and evaluate their effectiveness, and update your risk assessment and data protection impact assessment accordingly. You should also train and educate your staff and stakeholders on data protection principles and best practices, and ensure compliance with GDPR and other relevant laws and standards.

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?