When information is exposed.
WHAT COUNTS
Unauthorised access to personal data Accidental disclosure Loss of data A compromised system holding data
WHAT TO DO IMMEDIATELY
Contain it: stop the exposure continuing
Establish what data was involved Establish whose data it was Record everything, with times
WHY RECORD TIMES
Notification obligations frequently run from when you became aware.
WHAT OBLIGATIONS MAY APPLY
Notifying an authority Notifying affected individuals
Within specified periods.
Take advice promptly on what applies to you.
WHAT TO TELL AFFECTED PEOPLE
What happened What data was involved What you have done What they should do How to contact you
WHAT NOT TO DO
Delay while deciding how it looks Minimise Say nothing
WHAT TO WARN THEM ABOUT
Stolen customer information is used for targeted fraud.
Tell them to be alert to messages claiming to be from you.
WHAT TO DO AFTERWARDS
Fix the cause, and document what changed.
