Privacy obligations while investigating.
WHAT HAPPENS DURING INVESTIGATION
Logs examined Data accessed Third parties involved Records preserved
WHY THAT CREATES OBLIGATIONS
Investigation is itself processing.
WHAT TO ESTABLISH
Your basis for it.
WHAT USUALLY APPLIES
Legitimate interests, or legal obligation.
WHAT TO LIMIT
Who is involved What they access What is copied
WHY
Incident response frequently spreads data further than the incident did.
WHAT TO BE CAREFUL WITH
Copying entire databases for analysis Sharing logs containing personal data with external responders Storing evidence in ungoverned locations
WHAT TO DO ABOUT EXTERNAL RESPONDERS
A processing agreement, before they start.
WHY BEFORE
Agreeing terms during an incident is impossible.
WHAT TO PREPARE IN ADVANCE
Arrangements with anyone you would call.
WHAT TO PRESERVE
What is necessary, in a controlled location.
WHAT TO DELETE AFTERWARDS
Working copies, once the matter closes.
WHY
They are frequently forgotten and unprotected.
WHAT TO RECORD
What was accessed and by whom.
WHY
Investigation access is itself subject to scrutiny.
WHAT TO REVIEW AFTERWARDS
Whether the response itself created new exposure.
