When must we tell people affected by a personal data breach, and what do we tell them?

Start

A personal data breach is confirmed

A breach does not need an attacker or for data to leave the organisation: data seen, altered, lost or only out of reach counts. The Data Protection Officer joins in the first hour. Telling people turns on the harm to them, not to the organisation.

• Then: Are we the controller for this data?

Decision

Are we the controller for this data?

As controller you decide and notify. As a processor you tell the controller and it decides whether anyone is told. Your applicability profile says which role you hold for which data. The pack does not say what to do while the role is unclear. A cautious reading, and your own judgement to make, is to assess the risk as though you were the controller while you find out.

• Yes, or not known: The Data Protection Officer assesses the risk to the people
• No, we are its processor: Tell the controller; it decides about the people

Outcome

Tell the controller; it decides about the people

Tell the controller without undue delay, within 24 hours of awareness in the pack's default, or sooner where the contract says so. Do not judge the risk for it first. Give it what it needs for its own notification: what happened, the data and people concerned, likely consequences, measures taken and a contact. In the pack the Data Protection Officer drafts and sends it, and the executive incident lead approves it as a customer notice.

Step

The Data Protection Officer assesses the risk to the people

Weigh seven factors: the type of breach, the nature and volume of the data, how easily people can be identified, how severe the consequences could be, who the people are, how many, and where the data went and whether it was recovered. It is a judgement, not a score. Encryption with the key safe, or deletion confirmed by a trusted recipient, can offset the rest.

• Then: What is the risk to the people concerned?

Decision

What is the risk to the people concerned?

Unlikely: no realistic harm, or any harm fully offset by protection or containment. A risk: some harm is realistic, but not severe or not likely. High: harm that is severe, likely, or both. One factor at high risk that nothing offsets is enough, however few people: one person's medical record sent to their employer is a high risk. In doubt between two levels, choose the higher and record why. The executive incident lead decides, on this assessment.

• Unlikely to result in a risk: Record it with the reasons; no notification or message
• A risk, but not high: Notify the authority and record it; do not tell the people
• High risk, or unsure whether it is high: Does one of the three exemptions apply?

Outcome

Record it with the reasons; no notification or message

No notification and no message to the people. The breach record is the only evidence the decision was made on time and for good reasons, so it carries the facts, the effects, the factors and the reasons in full. The authority may ask to see it. NIS2, DORA and other notices are decided separately.

Outcome

Notify the authority and record it; do not tell the people

Notify the supervisory authority without undue delay and, where feasible, within 72 hours of awareness; later only with the reasons for the delay. Record the breach too. Revisit the risk as facts come in: if it rises to high, the people must then be told. The authority may also require you to tell them.

Decision

Does one of the three exemptions apply?

First, the data was protected so that it is unintelligible to anyone not authorised, for example by strong encryption with the key not compromised. A spreadsheet whose password went in the same email does not count. Second, measures taken since mean the high risk is no longer likely to materialise, such as a stolen device recovered unopened. Third, telling each person would take disproportionate effort; a public communication then informs them as effectively. Record which applies and the evidence.

• Unintelligible data, or high risk no longer likely: No message; give the authority the reason and evidence
• Disproportionate effort: Take legal advice, then plan a public communication
• None, or not sure: Draft it in clear and plain language

Outcome

No message; give the authority the reason and evidence

The authority is still notified. The notification and the breach record name the condition and its evidence: the encryption used and where the key was, or the measures taken, when, and why they remove the high risk. Write it in words the authority can test, because it may disagree and require you to tell the people.

Step

Take legal advice, then plan a public communication

A public notice replaces individual messages only where it informs people as effectively. Publish it where the people affected will see it, such as the website or customer portal. Describe who is affected so people can tell, and how they can check without details going online. Record why individual messages were disproportionate.

• Then: Draft it in clear and plain language

Step

Draft it in clear and plain language

Say what happened and that it involves the reader's information; which kinds of information, and which were not involved; what could happen, honestly and with how likely; what you have done; specific steps they can take today; and a named contact with a phone number. No legal terms, no sign-in links or attachments, and say what you will never ask for. Say sorry, and admit no liability Legal has not reviewed.

• Then: Approve with the executive incident lead and the DPO

Step

Approve with the executive incident lead and the DPO

The Data Protection Officer drafts with the communications lead, and Legal reviews. The executive incident lead approves, with the Data Protection Officer. Someone checks that every fact and number agrees with the notification to the authority. Brief and staff the enquiry line before anything is sent, because people who receive a breach notice call.

• Then: The communications lead sends it without undue delay

Outcome

The communications lead sends it without undue delay

Only the communications lead sends it: by email, by letter where there is no safe email address, or as the public notice. Record who it went to, what was not delivered and what was done instead. Tell the authority it was sent, in the follow-up to the notification, and record it in the breach record.