Question 1

What is a data breach?

Accepted Answer

A data breach occurs when personal data is unintentionally or unlawfully disclosed, altered, deleted, or otherwise compromised. This can be caused by various factors such as cyberattacks, human errors, technical failures, or malicious actions. A data breach can lead to violations of data protection laws and can have significant consequences for affected individuals as well as the organization involved.

Specific examples of data breaches:

Emails with an open distribution list (e.g., email addresses not all placed in BCC)
Theft or loss of data carriers (e.g., smartphone, laptop)
Improper disposal of data (e.g., payroll documents not shredded and thrown in the paper waste)
Incorrect allocation of access rights (e.g., a salesperson gaining access to HR/personal data)
Cyberattack (e.g., phishing, malware)

Question 2

What can happen in the event of a data protection incident?

Accepted Answer

In the event of a data breach under the General Data Protection Regulation (GDPR), various consequences and penalties may arise, depending on the severity of the breach and the specific circumstances of the case.

Here are some possible consequences:

Fines: Maximum penalties of up to €20 million or 4% of the global annual revenue.
Order for Actions: Authorities can mandate measures to rectify the breach or halt data processing.
Warnings and Reprimands: For less serious violations, authorities may initially issue warnings or reprimands.
Reputational Damage and Loss of Trust: Data breaches can lead to significant trust erosion and damage to reputation.
Civil Lawsuits: Individuals whose data protection rights have been violated may seek compensation.
Criminal Consequences: In severe cases, there may also be criminal repercussions, such as fines or imprisonment.

It is important to note that the exact consequences and penalties can vary depending on the circumstances of the case and the applicable national data protection laws. In any case, compliance with data protection regulations is crucial to avoid legal issues and financial penalties.

Question 3

When is a fine likely to occur, and how much will it be?

Accepted Answer

Under the General Data Protection Regulation (GDPR), fines can be imposed for violations of data protection laws. The amount of these fines varies depending on the type of violation and can reach up to €20 million or 4% of the global annual revenue from the previous financial year, whichever amount is higher.

There are various categories of violations that can incur fines, including:

Violations of the principles of the GDPR, including breaches of the lawfulness, fairness, and transparency of data processing.
Infringement of the rights of data subjects, such as the right to information, the right to erasure, or the right to data portability.
Non-compliance with the requirements for obtaining consent for data processing.
Violations of the obligations of data controllers or processors regarding the security of personal data.
Failure to comply with the reporting obligation in the event of a data breach.

The exact amount of the fine is determined by data protection authorities and may vary depending on the circumstances of the case. Severe or repeated violations are typically subject to higher fines. It is important to note that fines apply not only to companies but also to authorities and other organizations that process personal data.

Question 4

How long do I have to report a data protection incident?

Accepted Answer

According to Article 33 of the General Data Protection Regulation (GDPR), data breaches must be reported without undue delay and, where feasible, within 72 hours of becoming aware of the breach, provided that the breach is likely to result in a risk to the rights and freedoms of natural persons. If it is not possible to report within this timeframe, the reasons for the delay must be communicated along with the notification.

It is crucial to report data breaches as quickly as possible to implement appropriate measures to protect affected individuals and to ensure compliance with the reporting obligations under the GDPR.

Question 5

How do I report a data breach?

Accepted Answer

The notification of a data breach should be directed to the competent data protection supervisory authority. Typically, this is the authority in the country where the company that committed the breach has its headquarters or a branch.

Here are the steps to follow:

Preparation: Gather all relevant information about the data breach, including the date, the nature of the breach, the affected data, and the potential impact on the individuals involved.
Contacting the Supervisory Authority: Submit your notification to the relevant data protection supervisory authority. In many countries, this can be done via an online form, by email, or by postal mail. You can usually find the contact information for the authorities on their official websites.
Details of the Notification: Describe the data breach as accurately as possible. Provide all relevant information, including when the breach occurred, the type of affected data, the cause of the breach, and any measures already taken to contain the issue.
Additional Documentation: If necessary, attach any additional documents or evidence that support or clarify the data breach.
Communication: Maintain open communication with the supervisory authority to provide further information if needed or to receive additional instructions.

It is essential that the notification of a data breach complies with the requirements of the General Data Protection Regulation (GDPR) to ensure that the supervisory authorities can respond appropriately and that the affected individuals are protected. As experienced specialists in this field, we are here to assist you! Having knowledgeable advisors or attorneys at your side is particularly beneficial when communicating with the supervisory authority, as this greatly increases your chances of avoiding fines.

Crisis Management & Fine Prevention in data protection

Fine prevention in data protection

Data protection crisis management

What to do in case of a data breach?

Our contact persons

FAQ - First Aid for Data Breaches