Breaches of personal data – notification under UK GDPR

The European Data Protection Board has opened a public consultation in relation to one of its guidelines on personal data breach notification under the GDPR. Although the UK has left the EU, the ICO has confirmed that these guidelines continue to be relevant to the UK data protection regime.
The above guideline is quite specific, relating to breach notification across member states, however, it presents a good opportunity for us to remind organisations of breach obligations more generally.

Reporting timeline and fines

Organisations must report personal data breaches to the ICO without undue delay, and where feasible within 72 hours of becoming aware of the breach. In some cases, organisations must also inform the individuals whose personal data is affected.
Failing to notify the ICO of all notifiable breaches can result in a fine of up to £8.7 million or 2 per cent of an organisation’s global turnover. The ICO’s other corrective powers can also be combined with the fine.

Notification to the ICO

Notification to the ICO must be made where a personal data breach is likely to result in a risk to individuals’ rights and freedoms. To assess whether this is the case, organisations should consider the specific circumstances of the breach and its potential impact. If an organisation decides against reporting the breach, it should document this and retain any relevant information it used to arrive at its decision that there is no risk to individuals’ rights and freedoms.
Information to include in a breach notification to the ICO:

• the details of the personal data breach, such as the type of personal data involved as well as the number of individuals affected;
•  a description of the likely consequences of the personal data breach;
• a description of actions that are (or will be) taken to deal with the personal data breach, or to mitigate its negative effects;
• the date and time the breach was detected;
•  the date and time the breach actually occurred (or an estimate); and
• the data protection officer’s name and contact details, or some other point of contact where more information can be obtained;

Because information must be provided without undue delay, it is an option for organisations to notify the ICO in stages if they do not have all of the details.