The First 72 Hours Managing Data Breaches

So My first question for you guys is what actually counts as a personal data breach and when does it need to be reported to the ICO? Good question.

One that's quite often gotten wrong isn't it?

Yeah absolutely and those first few hours are critical really as to what you do or don't do at that point.

I think one of the things Amy and I probably come across the most is what actually is a breach because that's the biggest thing here.

It's all right saying you know what should we be doing when we've encountered a breach but Nine times out of 10, I think a lot of my clients aren't really sure what a data breach really is.

And so they can send a few hairs off racing, can't they, I mean, panic around what they think is wrong at that point.

When I say to clients, you know, have you had any data breaches? If I'm doing a gap analysis and ask them the questions around data breaches, they say, no, no, no, we've never been hacked.

We've never had a phishing attack.

And they assume that a data breach is only when someone has accessed their systems, got in and taken something.

I think because that's the common misconception you see on the news, you see in movies, you know, cyber attacks, stealing information.

And everyone believes that's what a data breach is

and

doesn't see anything past that.

And a data breach is so much more, isn't it, Amy?

Yeah, absolutely.

I mean, data breaches can be anything from.

wrong email going to the wrong person um to somebody gossiping about personal data about somebody else in the canteen um all the way through to a full-on hack where they've actually a threat actor has actually accessed your systems and has started to take control of it um the range is huge um about what a breach can be.

And it's not, I think the terminology is what causes the confusion.

If you break it down, you've got a security incident, you've got data breaches, and you've got a breach of GDPR, which there are three different things, but one incident can have all three of those breaches, whereas one incident could just be one of them.

So a phishing email, which is blocked, for example, is just a security incident.

Whereas an organisation that's keeping data, personal data for 50 years when it doesn't need to and doesn't have a good retention policy is a GDPR breach.

So you've got those different aspects within the different incidences as well, which I don't think people really understand very well.

And that's what I'm saying.

I think it's really important to define quite quickly, is it a data breach? You know, the legislation basically says that a data breach is where someone accesses information they're not entitled to have.

It's really that simple.