How to Respond to a Data Breach: A Practical Guide
Reducing risk in data breach response
The initial phase of data breach management involves identifying the compromised data and assessing the impact on the organisation. In the gap between identifying an incident and the expiration of the 72-hour reporting window under the UK GDPR, a DPO must consider the steps that can be taken immediately to reduce the risk to data subjects and to stop the exposure from escalating. It’s also an opportunity to begin to compile the necessary audit evidence required to satisfy the ICO.
Human intervention
For incidents involving misdirected correspondence, a DPO may find that direct human intervention rather than technical tools has the biggest impact. If an email containing personal data is sent to an incorrect inbox, it can be effective to contact the recipient directly to establish their identity and evaluate the exposure. Official guidance is clear that whether the individual is a trusted recipient (such as another professional bound by statutory confidentiality duties) or a random member of the public materially alters the risk assessment.
Instructing them to delete the file from both their primary inbox and their deleted items folders can often be the only method available to a low-resource data protection team. Make sure you obtain a written confirmation of deletion.
While the DPO does not execute technical security protocols, depending on the size of your organisation, it may be your responsibility to direct the IT department to isolate exposed data infrastructure. If data is exposed via an active cloud storage link (such as a Google Drive or SharePoint) or through compromised user credentials, instruct technical staff to revoke access permissions or deactivate the sharing links immediately. If you are lucky, restricting access before unauthorised parties can download or view the file greatly minimises the risk of harm to the data subjects. Rapid technical isolation is a primary mitigating action and is often overlooked as a practice point by technical teams who assume that the tools will work when they need it. Remember, it’s rare that risk is ever fully eliminated, and you should record any outstanding risk on your breach register – be critical of yourself and demonstrate to the ICO that you really understand what’s at stake.
Physical data breaches
The misdirection of physical documents such as letters or printed case files is a common type of data exposure. You cannot assume that an unintended recipient will correctly dispose of sensitive paperwork or perform any disposal at all. That data remains a live risk until it is secured. To mitigate this, the DPO can consider coordinating the retrieval of the documents via a secure courier. It can be expensive, but depending on the sensitivity of the data, it can be a justifiable measure to ensure maximum effort towards compliance.
If the recipient is an external organisation with verified, secure confidential waste facilities, you can consider requesting a formal certificate of destruction. Storing this certificate within your internal logs provides the ICO with clear evidence of active risk reduction.
Preparation
Systemic tool failures can cause complex expanding breaches. This could be a malfunctioning customer portal exposing user profiles, or a triaging script sending communications to the wrong location. You may find that operational teams can resist system downtime, as they are concerned about business continuity, but as a DPO, monitoring compliance and protecting the rights and freedoms of data subjects is your primary concern. There are times when you will need to advocate for the isolation or shutdown of the affected processes or systems. Prioritising business continuity over data security is a factor that has the potential to increase financial penalties during an ICO investigation.
Data breaches are an unfortunate reality, but the severity of the impact depends entirely on your organisation’s preparation.
Maintaining pre-drafted communication templates for urgent deletion requests, establishing clear plans for recovering physical data, and having in place policies for technical staff to pre-authorise when a system can be isolated without having to consult with SLT can put you ahead, allowing you to focus on preparing clear, documented evidence of accountability rather than scrambling during a breach.
Did you enjoy this practical guide? Explore our 5-step How to Navigate Data Breaches video series here.
