Oposiciones →
Module 5 of 7 · 15 min

Data breaches: what they are and what to do

Free data protection course: read the module, review with the questions and move on to the next one. At the end, a test and a PDF certificate.

Module 5 of 7 · Course contents

A personal data breach is any incident that destroys, loses or alters data, or lets an unauthorised person see or receive it, whether accidental or unlawful (GDPR, article 4.12).

Examples

  • An email with data sent to the wrong person.
  • A lost or stolen laptop or USB stick.
  • A virus that encrypts files.
  • Papers with data thrown in the bin without shredding.

What must happen

The controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people, and must always document it (article 33). So your part is to report it at once through your employer's channel: the clock runs from the moment it is known.

In practiceIf you send the whole department's payslips to a customer by mistake, do not hide it or wait until Monday: tell your manager or the data protection officer right away.

Source: Regulation (EU) 2016/679, General Data Protection Regulation (GDPR), articles 4.12 and 33

Quick review

Check that you've understood. These are questions from the final test: tap an answer to see whether it's right and why.

Sending an email with customer data to the wrong person by mistake is…

Within what time must the controller notify a breach to the authority, where feasible?

You lose a USB stick with patient data. What do you do?

Module practice test

5 new questions, different from the final test. Tap an answer to see whether it is right, why, and which rule it comes from.

1. Is a virus that encrypts files with customer data a breach?

2. What must a processor do if it suffers a breach?

3. What must a breach notification describe?

4. Must a breach be documented even if it is not notified to the authority?

5. When is notifying the authority not required?

Course contents