Data Breach Response

What Is Data Breach Response?

Article 33 gives an organisation 72 hours to notify its supervisory authority once it becomes aware of a personal data breach. Here you are the employee who caused one, by sending customer records to the wrong email address. You recognise the misdirected email as a breach, report it through the internal portal instead of hoping nobody notices, and document an exact timeline for the Data Protection Officer, who decides whether the regulator and the customers must be told.

What You'll Learn in Data Breach Response

• Recognise that a misdirected email containing personal data is a breach under GDPR Article 4(12)
• Report a breach internally at once, with the records, data categories and containment steps the DPO needs
• Explain when a breach goes to the supervisory authority and when a high risk means individuals must also be told
• Explain why the 72-hour clock runs from awareness, not from the end of the investigation
• Document an exact incident timeline that supports the organisation's accountability duty

Data Breach Response — Training Steps

1. Introduction

   Today's training will teach you about GDPR data breach notification requirements - one of the most critical compliance obligations any organization handling personal data must understand.

2. Routine Data Export

   Alice is preparing a routine customer data export for VendorPartner Inc., a legitimate third-party integration partner. The spreadsheet contains 847 customer records including names, email addresses, phone numbers, and mailing addresses. This is a standard weekly task that Alice has done dozens of times before. She opens her email client to send the file to John Smith at VendorPartner.

3. The Mistake

   Alice finishes typing the email and hits send. A couple of minutes later, she glances at the 'Sent' folder and notices something wrong. The email was sent to john.smith847@gmail.com instead of the correct address: john.smith@vendorpartner.com - the autocomplete suggested a similar-looking personal Gmail address, and Alice clicked it without checking carefully. 847 customer records are now in the hands of an unknown person.

4. The Critical Decision

   Alice's heart sinks. Her first instinct is to hope nobody notices - maybe the recipient will just delete it? Maybe she can pretend it never happened? But Alice remembers her GDPR training. A data breach includes 'accidental or unlawful disclosure of personal data.' Sending customer records to the wrong email address clearly qualifies. Under Article 33 of GDPR, her company must notify the supervisory authority without undue delay and, where feasible, no later than 72 hours from becoming 'aware' of the breach. The clock starts now, not when the investigation finishes.

5. Accessing the Incident Portal

   Alice decides to do the right thing and report the incident immediately. She opens the company's internal incident reporting system. DataGuard Solutions has a dedicated breach reporting portal that connects directly to the Data Protection Officer (DPO) and the incident response team.

6. Filing the Breach Report

   Alice fills out the incident report form with complete details about the misdirected email. Being thorough and honest is essential - the DPO needs accurate information to assess the breach severity and determine notification requirements.

7. DPO Response

   Within minutes of submitting the report, Alice receives a call from Dr. Sarah Chen, the company's Data Protection Officer. Dr. Chen thanks Alice for reporting immediately and explains how the breach assessment process works under GDPR.

8. Understanding the 72-Hour Rule

   Dr. Chen explains the key GDPR requirements: Article 33 : Controllers must notify the supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming 'aware' of a breach The clock started when Alice realized the email went to the wrong address - not when investigation finishes Weekends and holidays do not extend the deadline. Notifying late does not remove the duty, but the notification must then explain the reasons for the delay Failure to notify can result in fines up to 10 million euros or 2% of global annual revenue The DPO will now assess whether this breach is 'likely to result in a risk to the rights and freedoms of natural persons' - if so, notification to the authority is mandatory.

9. Containment Actions

   The incident response team has begun containment actions: Email recall attempted, although a recall cannot pull a message back from an external Gmail inbox IT Security is analyzing server logs Legal team has been notified The unknown Gmail recipient has been contacted requesting deletion Dr. Chen explains that even with containment efforts, the breach must still be documented and potentially reported. The key question is whether the breach poses a risk to the affected individuals.

10. Documenting the Incident

    Even if notification to the supervisory authority is not required, GDPR mandates that all breaches must be documented internally. Alice is asked to provide additional documentation about the incident, including the exact timeline and any evidence she has.