a personal data security breach
Our new white paper, GDPR - Handling Personal Data Security Breaches in Three Phases, considers the formal requirements for handling a personal data security breach in accordance with GDPR and sets out guidelines for the preparation and anchoring of appropriate contingency measures.
Treating Security Breaches According to the GDPR
When public and private organisations are required to comply with the requirements of the General Data Protection Regulation (GDPR), reminding ourselves of the purpose of the regulation may be a helpful step. For many years, some organisations have had a commercial interest in acquiring and storing personal data. Enforcement has been somewhat sporadic, to say the least, in cases where the organisations in this process are in breach of the legislation, and has therefore not served as a significant deterrent. The implementation of the GDPR will finally bring this practice to an end. In future, organisations must have a meaningful and objective purpose for acquiring personal data. They must store, protect, and delete this personal data in accordance with exacting security standards. Organisations must also be able to document everything they do. If they are unable to do so, organisations risk incurring serious fines.
It therefore also makes sense for GDPR to contain formal requirements regarding the way in which a personal data security breach must be handled. When an organisation acquires data concerning a data subject, the data is provided in confidence. When something goes wrong and there is a breach in this confidence, data subjects and the authorities acting on behalf of citizens may demand to know what has gone wrong and the measures that have been taken to ensure that it does not happen again.
This new white paper, GDPR - Handling personal data security breaches in three phases, reviews the requirements imposed in the EU GDPR. The white paper starts by defining what personal data is, the distinctions between the various types of security breaches, and the consequences that a personal data security breach could have for the data subject. The white paper then sets out recommendations for the establishment and anchoring of appropriate contingency measures, including fixed exercise routines and a process-based action plan in three phases.
