GDPR Data Breach: What You Need to Know

The General Data Protection Regulation (GDPR) came into force on 25th May 2018, marking a seismic shift in how organisations handle personal data. The regulation aims to harmonise data privacy laws across Europe, protect and empower all EU citizens’ data privacy, and reshape the way organisations approach data privacy. One of the most critical aspects of GDPR compliance is managing data breaches.

A data breach, under GDPR, refers to a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. In this expanded guide, we will explore everything you need to know about GDPR data breaches, from understanding what qualifies as a breach, the reporting process, potential penalties, and best practices for mitigation.

What Is a Data Breach Under GDPR?

Before diving into the nuances of GDPR data breaches, it is essential to have a clear understanding of what constitutes a breach under the regulation. Article 4 of GDPR defines a personal data breach as any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed.

This definition highlights three distinct types of data breaches:

1. Confidentiality Breaches – This occurs when there is an unauthorised or accidental disclosure of, or access to, personal data. For instance, if an employee sends personal data to the wrong recipient or a hacker gains access to an organisation’s database.
2. Integrity Breaches – These breaches involve unauthorised or accidental alterations of personal data. For example, data being altered or tampered with by an unauthorised person can compromise the integrity of the information held by an organisation.
3. Availability Breaches – This type of breach occurs when there is an accidental or unauthorised loss of access to, or destruction of, personal data. For example, if personal data is lost or deleted by mistake, it would be considered a breach of availability.

It is crucial to note that a breach can occur accidentally or as a result of malicious activity, such as a cyberattack.

Responsibilities of Data Controllers and Processors

GDPR places responsibilities on both data controllers and data processors when it comes to handling personal data breaches.

• Data Controllers are entities that determine the purposes and means of processing personal data. They hold the primary responsibility for ensuring GDPR compliance. In the event of a breach, the data controller is responsible for reporting the breach to the relevant supervisory authority and, in certain cases, to the affected individuals.
• Data Processors are entities that process personal data on behalf of the data controller. While they do not have the same level of responsibility as data controllers, they are required to notify the data controller of a breach without undue delay.

The Data Breach Notification Process

One of the central tenets of GDPR is the requirement for organisations to report data breaches in a timely manner. Article 33 outlines the obligations of data controllers regarding breach notifications. Let’s walk through the process step by step:

Assess the Breach

The first step after discovering a breach is for the data controller to assess its severity. Not all breaches need to be reported to the supervisory authority. Under GDPR, a breach only needs to be reported if it is likely to result in a risk to the rights and freedoms of individuals.

Factors that should be considered during the risk assessment include:

• The nature, sensitivity, and volume of personal data involved
• The ease of identification of the individuals involved
• The potential consequences for the affected individuals, such as identity theft, financial loss, reputational damage, or discrimination

For example, if a breach involves encrypted personal data and the encryption key has not been compromised, the risk to individuals may be low, and the breach might not need to be reported.

Notify the Supervisory Authority

If the risk assessment concludes that the breach is likely to result in a risk to the rights and freedoms of individuals, the data controller must notify the relevant supervisory authority. The notification must be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach. If the notification is delayed beyond this period, the data controller must provide a reason for the delay.

The breach notification must include the following information:

• The nature of the personal data breach, including the categories and approximate number of individuals affected and the categories and approximate number of personal data records concerned
• The name and contact details of the organisation’s Data Protection Officer (DPO) or other contact point for more information
• The likely consequences of the personal data breach
• The measures taken or proposed to address the breach and mitigate its possible adverse effects

If the full details are not available within the initial 72-hour window, the data controller can provide information in phases, as long as the delay is justified.

Inform the Affected Individuals

In certain circumstances, the data controller must also notify the individuals affected by the breach. This notification is required if the breach is likely to result in a high risk to the rights and freedoms of individuals.

The notification to individuals should include:

• A description of the nature of the breach
• The name and contact details of the DPO or other contact point for more information
• The likely consequences of the breach
• The measures taken or proposed by the organisation to mitigate the adverse effects

It is essential that the notification is made promptly to help individuals take appropriate measures to protect themselves, such as changing passwords or monitoring their accounts for suspicious activity.

However, if the organisation has implemented measures to render the data unintelligible (e.g., encryption), or if the risk of harm is low, notification to individuals may not be necessary.

Data Breach Penalties Under GDPR

GDPR introduced stringent penalties for non-compliance, and data breaches can result in significant fines. The regulation allows for two tiers of fines, depending on the severity of the breach:

1. Lower Tier – Organisations can be fined up to €10 million, or 2% of their global annual turnover (whichever is higher) for less severe breaches. These include failures to report a data breach within the required timeframe or failures to implement sufficient technical and organisational measures to ensure data security.
2. Upper Tier – For more severe breaches, such as failing to secure the rights of individuals or unlawfully processing personal data, fines can be as high as €20 million, or 4% of the organisation’s global annual turnover (whichever is higher).

It is important to understand that these fines are not the only consequence of a data breach. Organisations may also suffer reputational damage, legal action from affected individuals, and loss of business.

Best Practices for Preventing Data Breaches

While no organisation can entirely eliminate the risk of a data breach, there are numerous steps that organisations can take to reduce the likelihood of a breach and minimise its impact. The following best practices should be considered as part of a comprehensive GDPR compliance strategy:

1. Implement Robust Security Measures

At the heart of preventing data breaches is the implementation of robust security measures. These measures should be tailored to the nature of the personal data being processed and the risks associated with it. Key security measures include:

• Encryption – Encrypt sensitive personal data both in transit and at rest to prevent unauthorised access in the event of a breach.
• Access Controls – Limit access to personal data to only those employees who need it for their role. Implement strong password policies and consider multi-factor authentication (MFA).
• Data Minimisation – Ensure that only the minimum necessary personal data is collected and processed. By limiting the volume of data, the potential impact of a breach is reduced.
• Regular Security Audits – Conduct regular audits to identify and address vulnerabilities in your security infrastructure.
• Employee Training – Employees are often the weakest link in an organisation’s security. Regularly train staff on data protection policies, recognising phishing attacks, and best practices for handling personal data.

2. Develop an Incident Response Plan

Having a well-defined incident response plan in place can significantly reduce the impact of a data breach. This plan should outline the steps to be taken in the event of a breach, including how to contain the breach, assess its severity, and notify the relevant parties.

The incident response plan should also assign roles and responsibilities to key members of staff, such as the DPO, IT security personnel, and legal advisors. Regularly review and test the incident response plan to ensure that it remains effective and up to date.

3. Conduct Data Protection Impact Assessments (DPIAs)

A DPIA is a risk assessment tool required under GDPR for certain types of processing activities that are likely to result in a high risk to the rights and freedoms of individuals. Conducting a DPIA allows organisations to identify potential risks and implement measures to mitigate them before processing personal data.

DPIAs should be conducted for new projects that involve the processing of personal data, as well as for existing processing activities that may have changed over time. The results of the DPIA should be documented and made available to the relevant supervisory authority upon request.

4. Ensure Accountability and Compliance

Accountability is a core principle of GDPR, meaning that organisations must be able to demonstrate compliance with the regulation. To achieve this, organisations should:

• Maintain Records of Processing Activities – Article 30 of GDPR requires organisations to maintain records of their processing activities. These records should include details such as the purposes of processing, the categories of personal data processed, and the security measures in place to protect the data.
• Appoint a Data Protection Officer (DPO) – Organisations that process large amounts of sensitive personal data are required to appoint a DPO. The DPO is responsible for overseeing data protection activities and ensuring GDPR compliance.
• Implement Data Protection Policies – Develop and implement data protection policies that set out the organisation’s approach to GDPR compliance. These policies should cover areas such as data retention, data subject rights, and breach notification procedures.

5. Regularly Review and Update Security Practices

The threat landscape is constantly evolving, and so too should an organisation’s approach to data security. Regularly review and update security practices to ensure that they remain effective in addressing emerging threats. This may include patching software vulnerabilities, updating encryption protocols, or enhancing access controls.

Conclusion

In the GDPR era, data breaches are a serious concern for organisations of all sizes. With stringent reporting requirements and the potential for significant fines, it is essential that organisations understand their responsibilities under the regulation and take proactive steps to prevent and mitigate the impact of breaches.

By implementing robust security measures, developing an incident response plan, conducting DPIAs, and ensuring accountability, organisations can reduce the risk of a data breach and demonstrate compliance with GDPR. However, it is equally important to remain vigilant and adaptable, as the data privacy landscape continues to evolve.

GDPR is not just about avoiding fines; it is about building trust with individuals by protecting their personal data and respecting their rights. In an increasingly digital world, organisations that prioritise data protection will be better equipped to thrive and build lasting relationships with their customers.