How to handle a data breach
Before we begin, there’s one question that needs answering – what exactly is a data breach?
A data breach is an incident in which personal data is lost, disclosed, altered or destroyed. The GDPR imposes a duty to record data breaches and in some circumstances report data breaches to the relevant supervisory authority.
GDPR stands for General Data Protection Regulation. It’s the core of Europe’s digital privacy legislation.
At its core, GDPR is a new set of rules designed to give EU citizens more control over their personal data. It aims to simplify the regulatory environment for business so both citizens and businesses in the European Union can fully benefit from the digital economy.
The reforms are designed to reflect the world we’re living in now, and brings laws and obligations – including those around personal data, privacy and consent – across Europe up to speed for the internet-connected age.
With this in mind, you might think that in the age of GDPR, a data breach would be any website owner’s worst nightmare, and it is.
But what constitutes a data breach?
A data breach is what we typically refer to as a security incident where confidential or sensitive data is exposed or released to a person or organisation who is not authorised to see it. Of course, a data breach is not always malicious.
It can simply be a result of an accidental release of information. However, the legal implications can be just as severe regardless of whether the breach is caused by malware, a targeted attack, a lost laptop or a stray email.
What are the most common types of data breaches?
- Cyber attacks – Cyber attacks are the most famous data breaches for good reason. They’re increasingly common, and unlike the other types of data breaches, they’re increasingly difficult to protect yourself against.
- Employee data theft – Employees might steal data for any number of reasons. The healthcare sector struggles with personal information theft used for stealing patient identities. In other cases, an employee might take data from a work product and bring it with them to their new employer.
- Human error – Data breaches that happened because of human error are very common. A lot more common that you’d might think. However, they tend to be the most simple type of data breach, which also means that they’re the most avoidable.
Unfortunately, many of these errors are very easy to commit. Attaching the wrong document, clicking a sketchy link, poor passwords, or simply CC’ing the wrong person in an email can all cause data breaches. - Theft/loss of property – The final common type of data breach is the theft or loss of property containing credentials or sensitive information.
How to prevent data breaches?
Some data breaches are unavoidable. While you should always take the appropriate measures to protect your data and resources, there is no 100% foolproof method for avoiding data breaches.
Your best chance is to follow appropriate security protocols for the category and volume of data you work with. However, because data breaches are so often the cause of human error, you need to do more than install an antivirus or a comprehensive security suite.
What do you do in case of a data breach?
- Contain the breach
Once you’ve discovered the breach, it is very important to immediately identify the compromised system and fix any data leaks. It’s also important to ensure that your critical systems are out of danger. The next step is to change passwords across the entire organisation. It is also important and enable multi-factor authentication wherever possible.
- Do a damage assessment
The next step is to assess the extent of the damage. For this, you may want to set up a team of internal or external resources to evaluate the situation, putting an action plan in place to resolve the issue.
- Communication
Communication is key after a breach. After assessing the damages, you should notify anyone affected by it – potential victims, employees, and other stakeholders. If it’s a major incident, you should also communicate proactively to the media. Don’t wait – as this could be the perfect opportunity for rumors to arise. Make sure you’re prepared with statements and answers to questions.
- Make a recovery plan
Sadly, many organisations don’t really work on improving their data protection strategies until after an incident has occurred. But by having a solid procedure for managing a data breach from day one, the business can save a great deal of money and time in case a data breach should occur.
As such, it’s very important to make sure you have a back-up plan and to make sure that things can go back to working normally as soon as possible.
Closing thoughts
A combination of security and transparency can help any company get through the worst data breach. By preparing for the worst, investigating breaches when they happen, and communicating with the right people, you can minimize both the effects of a breach and the damage to your reputation.