When data is exposed or lost.
WHAT COUNTS AS A BREACH
Unauthorised access Accidental disclosure Loss of data Destruction or alteration Loss of availability, in some circumstances
WHY AVAILABILITY COUNTS
Data you cannot access may prevent you meeting obligations.
WHAT TO DO FIRST
Contain it.
WHAT CONTAINMENT MEANS
Stopping ongoing exposure.
WHAT TO DO SECOND
Preserve evidence.
WHAT TO ESTABLISH
What data Whose How many people How it happened Over what period What harm could result
WHY HARM MATTERS
It determines notification obligations.
WHAT NOTIFICATION TYPICALLY REQUIRES
Informing the regulator within a defined period Informing affected individuals where the risk to them is high
WHY TO KNOW YOUR TIMEFRAME PRECISELY
It is short, and it starts when you become aware.
WHAT TO TELL INDIVIDUALS
What happened What data was involved What you have done What they should do How to contact you
WHAT NOT TO DO
Delay hoping it resolves Understate the scope Go silent
WHAT TO PREPARE IN ADVANCE
A plan, contacts, and templates.
WHY IN ADVANCE
There is no time to write them during an incident.
