Every organization that processes personal data needs to know what to do when a personal data breach occurs. An incident-response procedure helps you act quickly, meet GDPR requirements, including notifying UODO within 72 hours, and limit the impact of an incident, both legal and reputational. This guide explains what the procedure is, what it should contain, how to use it and how AI is changing breach management.
In the previous article, I discussed personal data protection policies. This article is another step toward effective GDPR implementation in your company.
What is a personal data breach response procedure?
A personal data breach response procedure is a document that sets out how your organization should act when it identifies a personal data breach. It is intended to ensure compliance with GDPR requirements (Articles 33 and 34) and limit the consequences of incidents.
Its specific purpose is to identify, investigate, report and manage a breach quickly in order to protect the rights of the people concerned.
What is a breach response procedure for?
- Incident management: it provides clear rules for responding to personal data breaches.
- Limiting the impact of a breach: it helps reduce risks to the rights and freedoms of the people concerned.
- GDPR compliance: it helps meet the duties to report a breach to the supervisory authority, such as UODO, and inform affected people.
- Identifying causes and improving safeguards: it enables you to analyze the causes of a breach and implement corrective measures.
- Protecting the organization’s reputation: a quick and effective response reduces the negative effect on the company’s image.
- Evidence for the supervisory authority: the procedure provides evidence of compliance with the accountability principle, meaning the duty to demonstrate that you comply with the GDPR.
What should a breach response procedure contain?
Definition of a breach
An explanation of what constitutes a personal data breach, such as a data leak, data loss, unauthorized access or accidental disclosure.
Scope of the procedure
Identification of whom the procedure covers (employees and processors) and which data it protects.
Allocation of responsibilities
Appoint the people or teams responsible for:
- reporting a breach,
- assessing risk,
- managing the incident,
- reporting to the supervisory authority,
- communicating with the people concerned.
Stages of breach response
1. Reporting the incident
- How and to whom should a suspected breach be reported?
- A form or report template.
2. Analyzing the breach
- Assess whether a breach actually occurred.
- Establish the scope and causes of the breach.
3. Assessing risk
- Analyze the impact on the rights and freedoms of natural persons.
- Determine whether the incident must be reported to the supervisory authority.
4. Reporting the breach
- Report it to the supervisory authority, such as the President of UODO, within 72 hours after the breach has been established.
- Required notification details: incident description, categories and number of people, causes, and measures taken.
5. Informing the people concerned (if the risk is high)
- When and how should people be informed about a breach?
- The content of the message to affected people.
6. Corrective action
- Steps to limit the impact of the breach and prevent similar incidents in the future.
7. Documenting the incident
- Enter detailed information about the breach in the “Personal Data Breach Register.”
Monitoring and review
Regularly analyze and update the procedure and data-protection measures.
How should you use the breach response procedure in practice?
- Implement it in the organization: train employees to recognize and report breaches.
- Use it in a crisis: the procedure provides a step-by-step guide when an incident occurs.
- Report breaches to the supervisory authority within 72 hours if there is a risk to people’s rights and freedoms.
- Inform affected people if the breach may create a high risk to the people concerned.
- Document every incident: maintain a breach register containing information about every incident, even if it was not reported to the supervisory authority.
- Analyze and improve: after every incident, analyze its causes and implement preventive measures.
Why does lacking a procedure create a real risk for your company?
- Implementing and following a procedure enables your organization to respond quickly and effectively to personal data breaches.
- It helps you meet legal obligations under the GDPR.
- It helps avoid financial penalties, which may reach EUR 20 million or 4% of annual global turnover.
- It protects the organization’s image and reputation from the negative consequences of incidents.
Without a procedure, the first incident could expose you both to a UODO fine and to an inability to demonstrate compliance with the accountability principle.
How does AI affect personal data breach response?
Artificial intelligence creates new challenges in breach management. The AI Act in force imposes duties on organizations concerning AI system transparency and risk assessment, directly affecting how breach procedures are designed and used.
Detecting breaches
AI can help your organization quickly detect potential incidents, analyze data and identify threats. Automated algorithms can monitor unusual data-processing patterns and immediately alert the relevant teams to potential breaches.
Risk assessment
AI systems can support risk analysis by assessing potential threats and effects on the people concerned. This requires appropriate oversight to avoid incorrect decisions resulting from AI misinterpreting data.
Transparency
If you use AI, you must clearly explain how the systems work, why they are used and how data is processed. Transparency regarding AI is required under both the GDPR and AI Act and directly affects customer trust.
Risk minimization
AI should be designed in line with Privacy by Design and Default: data should be processed only to the minimum extent necessary. Data that is not needed to achieve the purpose should be eliminated to reduce breach risks.
What does this mean in practice?
Using AI in a breach response procedure can enable faster incident detection and response. It also requires:
- appropriate oversight of AI systems,
- transparency toward the people concerned,
- limiting data processing to what is necessary,
- meeting both GDPR and AI Act requirements.
Summary
A personal data breach response procedure helps you reduce risks and ensure GDPR compliance. As artificial intelligence develops, the procedure should also address AI-related matters such as transparency, data minimization and oversight of systems. Regular audits and monitoring processors are fundamental to data security in your organization.
If you want to know how to implement a breach response procedure effectively and meet GDPR and AI Act requirements, contact our law firm. We can help you plan and implement appropriate measures.
Q&A: personal data breach response procedure
What is a personal data breach?
It is any accidental or unlawful event that results in the loss, alteration, unauthorized disclosure of or access to personal data.
When must a breach be reported to the President of UODO?
When there is a risk to the rights and freedoms of natural persons. Submit the report within 72 hours after detecting the breach.
Must affected people be informed?
Yes, if the breach creates a high risk to their rights and freedoms.
What should a notification to UODO contain?
A description of the breach, categories and number of people, the type of data and the remedial measures used.
What are the consequences of having no breach response procedure?
UODO may impose financial penalties of up to EUR 20 million or 4% of global turnover, and the company’s reputation may suffer. The company may also be unable to demonstrate compliance with the GDPR accountability principle, which the supervisory authority will assess to its detriment.
