A data breach or incident involving personal data can occur regardless of how good your organisation's routines and processes are. It is very important to work both consciously and proactively, as well as to have a plan for how to handle an incident as quickly and efficiently as possible.
Based on the recommendations from the Swedish Authority for Privacy Protection (IMY), we have developed a checklist to guide your organisation in preparing for a personal data breach and how to report it.
Reporting personal data incidents
- You have routines to assess the risks for the individuals affected by a personal data incident.
- You know which authority is responsible for your operations, i.e. whether it is IMY or the supervisory authority in another EU country than Sweden.
- You have routines to notify IMY if a personal data incident has occurred. The routine states that you must report the incident within 72 hours after discovering it.
- You report even if you do not yet have all the details. You know what information you must provide to the Swedish Authority for Privacy Protection when a personal data incident has occurred. This often means you need to collaborate with, for example, your cloud service provider in cases where the information is stored in the cloud.
- You have routines to inform the data subjects when a personal data incident is likely to result in a high risk to their rights and freedoms.
- You know that in such cases you must inform the data subjects immediately.
- You know what information about the personal data incident you must provide to the data subjects, and that you should give advice to help them protect themselves against its effects.
- You document all personal data incidents, including those that do not need to be reported to IMY.
How many could you tick off on the list?
Download our comprehensive guide to personal data in the cloud to learn more about personal data management.
