Operational suites

Personal data breach suite

Reporting, triage, containment, role determination, awareness time, risk assessment, notification, communication to data subjects, processor escalation, evidence preservation, remediation and closure.

A stolen laptop containing an unencrypted customer export at a logistics firm starts the seventy two hour clock the moment someone in the organisation becomes aware of it, whether or not that person understands the significance straight away. The breach register exists to make that moment unambiguous and to hold every step taken afterwards.

Working the breach through Prudence means recording the moment of awareness, assessing the risk to the people affected, deciding whether the supervisory authority must be told, and, where the risk is high, communicating to the individuals themselves.

The proof is that the seventy two hour clock is visible on the register row from the first entry, that a decision not to notify always carries its reasoning, and that every step taken, containment, assessment, notification, remediation, is held as evidence against the same record.

Regulation

Articles 33 and 34

Registers

Data breach · Entity · Processing activity · Risk · Measure · Privacy action

The steps

1. 01Open the Data breach register and use the plus button beside the register title to record the breach.
2. 02On the Details tab, record the moment of awareness; the seventy two hour clock starts immediately and appears on the register row.
3. 03Record the containment steps taken on the Details tab.
4. 04Open the Assessment tab and assess the risk to the rights and freedoms of the people affected.
5. 05Where notification to the supervisory authority is required, complete the notification fields before the clock expires; where it is not, state the reason in the field provided.
6. 06Where the risk is high, open the Linked records band and use "Link a record" to attach the affected data subject sets, and draft the communication to them.
7. 07Where a processor is involved, use "Link a record" to attach the processor entity and record its escalation.
8. 08Open the Privacy actions register to raise remediation, then move the breach from Open to Closed on the lifecycle bar with the evidence attached.

Accepted when

• The seventy two hour clock runs from awareness and is visible on the register row.
• A decision not to notify has to carry its reasoning.
• The breach record holds the evidence of every step taken.