Breach readiness

Two quick questions so we only show you the sections that apply. These are not scored.

1. Do any outside organisations handle personal data on your behalf — for example a payroll bureau, IT provider, cloud software, booking system or mailing tool?
2. Do you handle personal data on behalf of other organisations, as their service provider (processor)?

In the first hours you need to stop the harm spreading and work out how serious it is for the people involved.

1. Do you have a written breach response procedure covering containment, risk assessment, notification and follow-up? Knock-out Evidence needed Data protection lead
2. Does your procedure give a simple way to rate the risk to individuals — considering the type of data, how many people, who they are and whether the data is protected (for example encrypted)? Data protection lead
3. Do you have contact details ready for the people you'd need in the first hours — IT support, key suppliers, insurer and legal adviser? Office manager / IT lead
4. Do you have cyber or data breach insurance, and do you know what the insurer needs you to do when an incident happens? Finance / Managing director

From the help text

A short written procedure means anyone can pick it up under pressure. 'Yes' means it exists, is current and the breach lead knows where it is.

Where a breach is likely to result in a risk to people, you must tell the Data Protection Commission without undue delay and, where feasible, within 72 hours of becoming aware. If the risk is high, you must also tell the people affected without undue delay.

1. Does your breach lead know that the 72-hour clock starts when you become aware of a breach — not when the investigation ends — and that you can send information to the DPC in phases? Breach lead
2. Have you looked at the DPC's online breach notification form and prepared the standing information it asks for (organisation details, contact person, what data you hold)? Data protection lead
3. Do you have a template for telling affected people about a high-risk breach, in clear and plain language? Data protection lead
4. If a breach became public, who would speak for you? Managing director / Chair

From the help text

Waiting for the full picture is a common reason for late notification. GDPR allows you to notify promptly with what you know and add details later.

If a supplier has a breach involving your data, you need to hear about it quickly — your 72 hours starts once you become aware.

1. Do your contracts with suppliers who process personal data for you require them to tell you about a breach without undue delay? Data protection lead / Contracts
2. Do you know where each key supplier would send a security alert, and is that inbox or phone monitored? IT lead / Office manager

From the help text

GDPR requires processors to notify the controller without undue delay, and this should be written into the processing contract. 'Yes' means your key suppliers' terms say so, ideally with a specific timeframe.

When you handle data for clients, you must tell them about a breach without undue delay so they can meet their own deadline.

1. Could you tell each affected client quickly — do you have their data protection contacts and a standard incident notice ready? Account manager / Data protection lead
2. Do you know the breach notification timeframes you've agreed in each client contract? Contracts / Account manager

From the help text

Your clients are relying on you to start their clock. 'Yes' means a client contact list for incidents and a template notice describing what happened and what you're doing.

Every breach must be documented — including the ones you decide not to report — and each one is a chance to improve.

1. Do you keep a breach register that records every breach — including ones you decided not to report — with the facts, effects, action taken and the reason for your decision? Evidence needed Data protection lead
2. After an incident or near miss, do you review what happened and update your procedures or training? Data protection lead

From the help text

GDPR requires you to document every personal data breach so you can show the DPC how you handled it. 'Yes' means a register is in use, even if it currently has few or no entries.

It's 4:40pm on a Friday. A colleague emails a spreadsheet with 240 people's names, home addresses and dates of birth to the wrong external address. The recipient is unknown and hasn't replied. Answer as you honestly think it would play out today.

1. What happens first? Breach lead
2. The recipient still hasn't responded by Saturday. What would your breach lead most likely do? Breach lead
3. When did you last run a breach drill or tabletop exercise? Breach lead
4. I confirm these answers reflect how we would actually respond today, and our breach lead has reviewed them. Managing director / Chair

From the help text

Speed of internal reporting decides how much of the 72 hours you have left. The best answer is the one your people would really do.