Security and personal-data breach response

Build the response before the incident

Define reporting channels, severity criteria, decision authority, evidence preservation, containment options and deputies. Make sure employees and processors know how to escalate a suspected incident quickly.

The first hours

Confirm what happened without destroying evidence, contain ongoing exposure, identify affected systems and information, establish when the organisation became aware, and begin the risk assessment. Record assumptions and decision times.

Notification and communication

S.I. 155 requires Authority notification within 24 hours of awareness. Where high risk to individuals is likely, affected data subjects must also be informed within 72 hours. Communications should be accurate, plain and useful.

The regulations also require cooperation, responses to Authority information requests within 14 days and an investigation report within 21 days from notification. Obtain professional advice on the exact timeline for the incident.

Security baseline

Use risk assessments, access control and periodic review, encryption where appropriate, resilient backups and restoration, logging, secure disposal, physical controls, vulnerability management, supplier checks and regular testing. Match controls to the nature, scale and consequences of the processing.