A data breach or incident involving personal data can occur regardless of how good your organisation's procedures and processes are. It is very important to work both consciously and proactively, and to have a plan for how to deal with an incident as quickly and efficiently as possible.
Based on the recommendations of the Swedish Data Protection Authority (IMY), we have developed a checklist to guide your organisation in preparing for a personal data breach and how to report it.
Reporting personal data breaches
- You have procedures in place to assess the risks to individuals who have been affected by a personal data breach.
- You know which authority is responsible for your business, i.e. whether it is IMY or the supervisory authority in an EU country other than Sweden.
- You have procedures in place for notifying IMY if a personal data breach has occurred. The procedure states that you must report the breach within 72 hours of discovering it.
- You report even if you do not yet have all the details. You know what information you must provide to the Data Protection Authority when a personal data breach has occurred. This often means that you will need to collaborate with, for example, your cloud service provider in cases where the information is stored in the cloud.
- You have procedures in place to inform data subjects when a personal data breach is likely to result in a high risk to their rights and freedoms.
- You know that in such cases you must inform the registered persons immediately.
- You know what information about the personal data breach you must provide to the data subjects, and that you should provide advice to help them protect themselves from its effects.
- You document all personal data incidents, even those that do not need to be reported to IMY.
How many could you check off on the list?
Download our complete guide to personal data in the cloud to learn more about handling personal data.
