Data breach procedures: a one-page plan

The short answer

A personal data breach is a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. That is broader than a hacker stealing a database: a lost device, an email sent to the wrong recipient, a misconfigured storage bucket, a ransomware attack that makes data unavailable, and a former employee with access they should not have are all capable of qualifying. When you become aware of one, you must assess the risk to the people affected. You notify your supervisory authority within seventy-two hours of becoming aware, in phases if necessary, unless you can demonstrate the breach is unlikely to result in a risk to their rights and freedoms. If you notify later than seventy-two hours, the notification must state the reasons for the delay. If it is likely to result in a high risk, you must also tell the people affected without undue delay, in clear plain language, unless an exception applies such as the data being unintelligible through encryption. Whether or not you notify, every breach must be documented internally, and that register is the first thing a regulator asks to see.

The one-page procedure

Step	What happens	Who	Timing
1. Report	Anyone who suspects a breach tells the named contact, without fear of blame	All staff	Immediately
2. Contain	Stop the exposure: revoke access, take a system offline, recall or block, change credentials	Technical lead and partner	Immediately
3. Assess	What data, whose, how many, what could happen to them, is it recoverable	Named responsible person with advice	Within hours
4. Decide	Can you demonstrate the breach is unlikely to result in a risk? If not, it is notifiable. Separately: is a high risk to individuals likely?	Named responsible person, documented	Before the deadline
5. Notify the authority	Nature, categories and numbers, likely consequences, measures taken	Named responsible person	Within 72 hours of awareness; in phases if needed
6. Inform individuals	Plain language, what happened, likely consequences, what you are doing, what they should do, a contact	Named responsible person	Without undue delay where high risk
7. Record	Facts, effects, decisions, reasoning, actions	Named responsible person	Always, notified or not
8. Review	Root cause, what changes, who owns it	Management	Within two weeks

Preparing before you need it

Telling the people affected

When it is required, the message should be direct: what happened, when, what data was involved, what the likely consequences are, what you have done, what they should do now, and a named contact. Avoid minimising language and avoid technical detail that obscures. People are more forgiving of a breach explained honestly and quickly than of one they learn about later or in a vaguer form than the facts warranted, and regulators take the same view.

What this means for you

Know what counts as a breach, assess risk when one occurs, notify your supervisory authority within seventy-two hours of awareness where notifiable, tell affected people where the risk is high, and document every breach regardless. Prepare the one-page procedure, name the responsible person, keep processor notification timelines to hand, and rehearse once. This is general information rather than legal advice; a serious breach warrants qualified help immediately.