Data Protection & Information Security Experts

What Should You Do After a Data Breach? A Guide for Businesses

Have you had a data breach? Your first thought may be to panic and worry about what to do next. But as long as you act on the breach quickly, you’ll prevent further damage down the line. 

In this guide, we’ll touch on the immediate steps to take after a breach and ways to prevent them from happening again. 

What Constitutes a Data Breach?

Data breaches happen all the time—in fact, 30 million people were affected in the UK just last year. So what actions cause one? Whether unlawfully or accidentally, a data breach results from loss, destruction, alterations, unauthorised access or disclosure of personal data processed. 

Examples include your employees falling for a phishing attack, failure to use Blind Carbon Copy (BCC) on a group email, or someone stealing a company laptop with confidential files. 

Human error is the root cause of most data breaches. While data protection is everyone’s responsibility, your senior team is responsible for minimising this negligence with data protection training.

Want to learn more about data breaches? Listen to the Data Protection Made Easy podcast for more insight. 

How Long Do You Have to Report a Data Breach?

You have 72 hours to report a data breach to the ICO unless it is unlikely to result in a risk to an individual’s rights and freedoms. If a risk is unlikely, you don’t need to notify the ICO, However, it is crucial to justify the reason why the breach was not reported in case a complaint arises from the personal data breach.

Depending on the data you process, a data breach can have serious implications, including financial loss, discrimination and loss of confidentiality. In serious cases, affected individuals, such as witnesses in high-profile cases, may be at higher risk of harm. 

How Should a DPO Respond to a Data Breach?

1. Find Out What’s Happened

You should first investigate what data was compromised, how the breach happened and how many people were involved. You need to know the source of the data, who the recipient of the data was, who the impacted data subjects are and whether there is any relationship between the parties involved. 

Data mapping will help identify who’s been affected and give insight into whether the data is high-risk or not.  

2. Contain the Breach

Once you know the source of the breach, start implementing security measures to prevent further damage from happening. Here are some immediate actions to take depending on the cause:

• Cyber incident – If your employees are victims of malware or phishing attacks, everyone should update their passwords and enable security protocols like two-factor authentication (2FA). 
• Human error – If personal data has been sent to someone by mistake, contact them immediately to delete it (if by email) or send it back securely. 
• Stolen company devices – If you offer hybrid working, your team may work in public spaces that are subject to burglary. Should this happen, your IT department should be able to wipe the device remotely so data doesn’t fall into the wrong hands. 
• Lost files – If you can’t locate confidential files, notebooks or other paperwork, search where you were last and ask others to help find it. 

3. Assess the Risk

Whether a breach is reportable or not depends on the risk it poses to others. At this point, you must conduct a risk assessment of the harm that may result from the breach. This assessment is different from a DPIA, which is conducted before processing activities begin.  

First, you need to identify the personal data that has been breached (again, data mapping is essential here). The risk to individuals will increase if the data is sensitive or high-risk. For example, a breach of financial information may lead to identity theft, which is detrimental to the individual. 

You also need to assess:

• Who may have the data – Was it breached internally or externally?
• How many people have been affected – Was it your customers, staff or shareholders – and how many have been affected? 
• How harmful will the breach be – Will the loss or unauthorised access to data lead to an unsafe situation, impact people’s well-being, or cause them to risk losing their jobs or homes? 

A risk assessment will determine the impact on individuals and identify ways to prevent this from happening again. 

4. Contact the Affected Individuals

In a recent statement, the ICO commented on organisations’ responsibility to protect individuals and show empathy when communicating after a data breach. 

Contacting the affected individuals is necessary if the data breach is high risk. When you acknowledge this incident, be empathic in your response and reassure them it won’t happen again. You may want to tell them what steps you’re taking and guide them on what they can do to stay safe during this time.

Even when not legally required to do so, organisations may opt to inform the data subjects affected in an attempt to maintain a reputation and to try to retain confidence between the data controller and the data subjects.

5. Send Your Report to the ICO (If Needed)

Once you’ve completed these steps, you may need to report your breach to the ICO. Remember, this has to be done within 72 hours of becoming aware of the breach, so don’t delay anything before doing it. 

Data Protection People Is Here to Help

While these steps seem daunting, you don’t need to go through them alone. Data Protection People are skilled in handling data breaches for businesses of all sizes and sectors. 

Our data protection support team will be with you throughout the process, from assessing the breach to preventing future risks with GDPR audits and training. 

Need urgent help? Contact our team today. 

How Serious Are Personal Data Breaches?

55% of adults have experienced a data breach—that’s around 30 million people in the UK alone. Losing or stealing personal data is more common than we think, and the consequences can be life-altering. 

Personal data isn’t just numbers seen on a screen. It’s bank details, addresses and medical information – the type of data you don’t share without a real purpose to do so.. A personal data breach exposes this information, allowing anyone to access it. Many believe the pain starts and stops there. But the real harm has only just begun. 

In this blog, we’ll uncover the aftermath of a data breach from an individual and organisational perspective. 

Assessing the Risks of a Personal Data Breach

A personal data breach will need to be reported to the information commissioners office unless it is unlikely to result in a risk to the individuals rights and freedoms. The type of personal data matters, especially if you handle special category data. However, context is also ket, it is important to establish all of the facts as quickly as you can to help your judgement as to whether there is any risk to the affected data subjects.

A breach of sensitive or high-risk data can seriously affect someone’s health and well-being, put them in harm’s way or risk losing money or their job. A data protection impact assessment (DPIA) will identify and minimise the risks involved in processing personal data. This is a preventative measure, though, and it is not something done after. 

In this case, you should follow our steps to respond to a data breach.  

How Do Data Breaches Impact Organisations?

Financial Damage

Organisations could experience considerable financial loss from the clean-up of a data breach. You may nned to compensate affected individuals, invest in better cyber security measures, pay legal fees and outsource a data protection consultant to help get you back on your feet. 

A personal data breach is also a fineable offence from the ICO, which could cost up to £17.5 million or 4% of your total annual turnover (whichever is higher). 

Reputational Loss 

When you lose the trust of your customers, stakeholders and staff, reputational damage comes as no surprise. News travels fast. Customers will turn to social media or the press to share their frustrations, driving prospects away from doing business with you.  

Reputational damage is long-lasting and will affect your chances to conduct new business in the future. 

Downtime 

Depending on the size of the breach, you may have to shut down your operations until all investigations have been conducted. Your data champion or data protection officer (DPO) will need to assess the severity of the breach, implement safeguards and address the ICO’s questions. This may take days or even weeks. 

Legal Implications 

Whether a data breach resulted intentionally or not, individuals have the right to seek legal compensation. This will contribute to your financial losses and potentially lead to more serious actions taken by the ICO. 

How Do Data Breaches Impact Data Subjects?

A data breach, if not addressed quickly, can have serious effects on individuals, which include:

• Financial loss: Individuals may lose money to identity theft or fraud. Those with confidential addresses, such as survivors of abuse, may have to relocate, resulting in considerable expenses.  
• Identity theft or fraud: If financial data gets into the wrong hands, hackers can steal a person’s identity and commit fraud. Not only will this victim lose money, but also struggle to get loans, credit cards or mortgages. 
• Loss of confidentiality: Medical information, religious or political beliefs and other special category data are confidential for a reason. When this security is broken down, an individual may face severe distress, discrimination, stigma or even physical danger.  
• Emotional distress: 30% of victims experience emotional distress, including anxiety, depression and physical illness. This is often a secondary effect of the impacts above.  

The ICO Warns Organisations: “You Must Do Better”

In a recent article, the ICO expressed concerns about organisations’ empathy and actions towards data breaches. These businesses must look beyond the operational damage and consider the “far-reaching ripple effect that disrupts [individuals’]  lives in ways that some may not fully appreciate.” 

If you ever go through a data breach, consider its impact on others. Take responsibility for what you’ve done, and as the ICO says, “step up, […] do better, and [….] recognise the critical importance of data protection in safeguarding people’s lives.” 

Listen to episode 193 of The Data Protection Made Easy podcast to learn more about ripple effects. 

Start the Year Compliant with a GDPR Audit 

With a GDPR audit, you can gain peace of mind knowing that your business is meeting the law’s requirements. Our expert team will assess your data-handling processes, identify weaknesses and implement a plan for continuous improvement to remain compliant year-round. Contact our team to learn more.

Had a data breach? Get urgent support now. 

The Latest Data Protection & Cyber Security News – December 2024

As we close out 2024, our Data Protection Made Easy hosts reflect on the year’s highlights and share the latest insights to help you overcome the challenges of the holiday season.

From practical tips to pressing data protection news, our episodes are packed with practical advice to keep your business secure during the festive break. Find out what you missed below. 

Data Protection Made Easy: December’s Recap 

Episode 197: GDPR Radio – News of the Week

We began December with our regular GDPR Radio coverage, which delves into recent news in data protection. Our hosts, Joe and Phil, invited Catarina Santos, a data protection consultant, back to discuss recent regulatory changes, industry trends and data breaches in the UK and EU. 

In our live discussion, we answered questions from listeners, providing practical advice they can take into their roles. Over 1,400 subscribers tune in monthly to hear from our experts, so if you want to stay up-to-date with the latest, subscribe to our podcast and find out what’s new. 

Need to catch up with GDPR Radio? Listen to episode 197 now. 

Episode 197: GDPR Radio – Data Protection Tips for the Festive Season

While you may have already settled down, now is not the time to let your data protection and cyber security measures take a back seat. The festive season often sees businesses letting their guard down, making them more susceptible to data security incidents as employees shift into ‘holiday mode’ and resources become stretched.

Amidst the festive cheer and goodwill, even seemingly harmless actions can pose security threats. Caine Glancy, our GDPR support desk consultant, joined us to discuss the risks of sending and receiving Christmas greetings, which are often used in phishing attacks to hook victims in. 

Always double-check your emails and sender address before opening an attachment or link. Otherwise, the only gift you’ll get is a data breach from a cyber criminal! 

If you plan to send your customers Christmas wishes, don’t forget to use blind carbon copy (BBC) to avoid exposing email addresses in bulk emails. You must also consider the Privacy and Electronic Communications Regulations (PECR) if your email includes promotional material. The PECR requires you to have explicit, informed consent from your customers, so don’t press send until you’re sure. 

For more guidance, head to our blog to learn how to avoid data protection incidents this Christmas. Prefer to hear straight from us? Catch up with episode 198 on Spotify.   

Episode 199: Final Episode of 2024

We end 2024 with our 199th episode of Data Protection Made Easy. In this episode, we reflect on the most popular episodes of 2024, which include:

• A Practical Guide on Data Protection Impact Assessments (DPIAs)
• AI and Its Potential Impact on Privacy
• Understanding the Role of a Data Protection Officer (DPO)
• Navigating the Complexities of International Data Transfers
• RoPA Roundup – A Practical Workshop for DPOs

We also have a heartfelt send-off for our long-standing host, Jasmine Harrison, who is leaving to travel the world. Jasmine has been an essential part of our team, and we wish her the best time travelling! 

Listen to the last episode of 2024 here. 

Looking for a New Podcast for 2025? 

Data Protection Made Easy is an award-winning GDPR and cyber security podcast with a community of over 1,400 subscribers. By subscribing, you can participate in live sessions with industry experts, catch up on the latest news and network with our growing community.

To start the new year off right, subscribe to Data Protection Made Easy on Spotify, YouTube and Amazon Music.

The Data (Use and Access) (DUA) Bill: What Changes Are Proposed to the UK GDPR?

When the Labour Party won the general election in July 2024, the previous government’s Data Protection and Digital Information (DPDI) Bill went out the window. 

The years the DPDI Bill progressed in parliament raised much commentary, with several discussions from our hosts at Data Protection People. With Labour in power, a new Bill has arrived – the Data (Use and Access) (DUA) Bill. 

Many have welcomed the changes proposed in the DUA, but how do they impact the existing data protection framework? Discover the key reforms set out in the DUA Bill in our guide.

What Is the DUA Bill? 

The Data (Use and Access) Bill aims to “unlock the secure and effective use of data for the public interest” while driving economic growth and improving people’s lives. The DUA Bill was published on 24 October 2024 to replace the previous government’s failed Data Protection and Digital Information (DPDI) Bill. 

This Bill carries over similar provisions set out in the DPDI Bill, including Smart Data schemes and digital ID. Some significant reforms have been dropped, such as changes to DPIAs and RoPAs. The controversial plan to remove the requirement for Data Protection Officers (DPOs) under certain criteria has been removed. 

For a complete list of its predecessor’s changes, read our summary on the DPDI Bill here. 

What Areas Are Subject to Change Under the Data Bill?

1. Data Subject Access Requests (DSARs)

The DUA Bill introduces a new article (12A) into the UK GDPR, setting clearer boundaries for managing subject access requests (SARs). Some notes include: 

• Organisations (controllers) can ask data subjects for more information in connection with a DSAR and have their time period for responding to the request paused until they receive the information. 
• A reasonable case for requesting further information is ‘where the controller processes a large amount of information concerning the data subject’. This can extend the applicable time period by two months.
• The personal data and other information provided in response to a SAR must be a ‘reasonable and proportionate search’ (clause 78). This gives controllers a legal basis for defining their search limits beyond relying on regulatory guidance. 

This provision varies from the DPDI Bill, in which data controllers no longer have the right to refuse SARs based on it being ‘vexatious or excessive’. The DUA Bill maintains the UK GDPR’s grounds for refusal if the SAR is ‘manifestly unfounded or excessive’. 

2. Legitimate Interests

The Bill proposes that controllers will be exempt from conducting a Legitimate Interests Assessment (LIA) if ‘recognised legitimate interests’ apply. These circumstances include processing necessary for national security, safeguarding vulnerable individuals or emergency response. (See Annex 1 in Schedule 4 of the Bill for all legitimate interests.) 

The DUA Bill also includes examples that may qualify as necessary for legitimate interests, including: 

• Direct marketing
• Processing to ensure the security of network and information systems
• Intra-group sharing of personal data for internal administrative purposes 

These examples are lifted from the EU GDPR (Recitals 47-49). Previously, organisations were uncertain whether these Recitals carried the same weight as the main text. By formalising these examples, the Bill delivers much-needed certainty for controllers about when they can rely on legitimate interests on a lawful basis. 

3. Automated Decision-making

Significant provisions surround automated decision-making. The DUA Bill intends to replace Article 22 with new Articles 22A—22D. The existing, stricter regime (Article 22) provides data subjects with the right to not be subject to a decision based solely on automated decision making unless certain conditions apply such as where the processing is –

• necessary for entering into, or performance of, a contract between the data subject and a data controller.
• required or authorised by domestic law which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests.
• based on the data subject’s explicit consent

Reducing this scope threatens individuals’ rights regarding automated decisions. Article 22C, however, sets out safeguards for protecting the individual’s rights, freedoms and legitimate interests. Measures include providing information about the decisions taken regarding the data subject and enabling them to contest such decisions.  

4. International Data Transfers

Like the DPDI Bill, the DUA Bill looks to amend the rules for international data transfers set out in Chapter V of the UK GDPR. Small changes include adapting the rules to a UK context, but most importantly, a ‘data protection test’ is introduced. 

The Secretary of State will assess whether a recipient country’s data protections provided to an individual are ‘not materially lower’ than UK standards rather than an exact likeness. This approach gives flexibility when conducting data transfers but requires organisations to be aware of the differing standards set internationally.  

5. Privacy Notices

The DUA Bill proposes that organisations are not required to provide privacy information under Articles 13 and 14 (e.g., via a privacy notice) if doing so is deemed ‘impossible or would involve a disproportionate effort’. 

This means controllers aren’t required to inform individuals about processing if the data is ‘de-identified’ or the notification would be impractical or unjustifiably costly. Watering down these transparency rules causes some concern, as it puts individuals’ rights at risk. 

Along with these five areas, the Data Bill proposes several other changes that impact data processing for research purposes, as well as an increase in PECR fines. 

What Are the Next Steps for the DUA Bill? 

The DUA Bill is still in its initial stages, meaning everything is subject to change as it passes parliament. As a close revision of the DPDI Bill, we expect it to progress quicker than its predecessor. 

Subscribe to the Data Protection Made Easy podcast for regular updates on the progression of the DUA Bill and expert commentary on industry events. 

Looking for Data Protection Support?

Our expert data protection services keep organisations compliant and their customers’ personal data safe. With years of sector experience, our GDPR consultants stay ahead of the latest regulatory changes, providing tailored advice to meet your compliance needs. 

Contact our team to find out how we can help you. 

Key Data Protection Trends and Challenges for 2025

Final Episode of 2024

Data Protection Made Easy Podcast – Final Episode of 2024: A Farewell to Jasmine Harrison

As we close out 2024, we celebrate the remarkable journey of the Data Protection Made Easy Podcast with a special episode dedicated to reflecting on the year gone by and bidding a heartfelt farewell to our esteemed co-host, Jasmine Harrison.

In this final episode, we take a trip down memory lane to revisit some of the top episodes and most memorable moments of the year. From insightful discussions on data protection challenges to deep dives into the latest cybersecurity trends. 2024 has been a year filled with engaging content and expert insights. But today, we also pause to celebrate Jasmine’s incredible contributions to the podcast, her dedication to the data protection community, and the impact she’s made over the years.

What to Expect in This Episode:

• A look back at the top episodes of 2024 that resonated with our audience and sparked important conversations.
• Highlights from Jasmine’s most memorable moments on the podcast.
• Reflections on how the podcast has evolved over the years and the milestones we’ve achieved as a community.
• A special farewell message to Jasmine and her future endeavours.

While we’ll miss Jasmine’s insight and energy on the podcast, we’re excited to continue delivering top-tier data protection and cybersecurity content in 2025. Stay tuned for more exciting episodes, new guest speakers, and fresh perspectives in the year ahead.

Thank You, Jasmine

Jasmine, your contributions have been invaluable, and we wish you nothing but the best in your future pursuits. Thank you for being a key part of our journey!

Listen to the final episode of 2024 and join us in celebrating Jasmine’s legacy on the podcast. You can listen back via the player below or you can tune in on Spotify and listen back on demand.

Top Tips for the Holiday Season

Festive Data Protection: Top Tips for the Holiday Season

The festive period is a time of celebration and reflection, but for organisations, it’s also a time when data protection risks can reach their peak. In episode 198 of the Data Protection Made Easy podcast, hosted by Caine Glancy, Phil Brining, and Susanne Reid, we explored the unique challenges businesses face during the holidays and shared actionable tips to keep your organisation’s data secure.

Why Are Data Protection Risks Higher During the Festive Season?

For many organisations, the festive period brings:

• Reduced Staff Coverage: With employees taking holidays, fewer team members are available to monitor systems, increasing the risk of breaches and delays in addressing incidents.
• Increased Cyber Threats: Cybercriminals take advantage of the holiday season, knowing that security protocols may not be as tightly monitored.
• Heightened Operational Pressure: Retailers, logistics companies, and other sectors face significant demand spikes, which can lead to oversights in data handling and security.
• Festive Marketing Campaigns: Increased use of personal data for marketing initiatives can expose organisations to compliance risks if not handled properly.

Identifying and Combating Festive Risks

In this insightful session, our hosts discussed the critical areas organisations should focus on during the holiday period:

1. Staff Awareness: Ensure all employees are trained to spot phishing emails, suspicious links, and other social engineering tactics.
2. Secure Remote Working: With many teams operating remotely or on reduced hours, it’s essential to reinforce secure access protocols and ensure all remote connections are encrypted.
3. Reviewing Permissions: Before the holidays, review and restrict access to sensitive data for staff who don’t need it during this period.
4. Incident Response Plans: Ensure your incident response team is on standby and that all employees know how to report data breaches or security issues.
5. Third-Party Risks: Monitor the activities of any third-party processors handling your data, especially if you rely on them during peak times.

Key Insights Shared by Our Hosts

• Caine Glancy provided practical advice for maintaining strong security protocols during periods of reduced staffing.
• Phil Brining highlighted real-world examples of holiday breaches and how organisations could have prevented them.
• Susanne Reid, making her debut on the podcast, shared valuable insights into compliance risks associated with festive marketing and data sharing.

Why Listen to This Episode?

Whether you’re a data protection officer, a business owner, or a professional tasked with managing compliance, this episode offers essential tips to navigate the unique challenges of the holiday season. From safeguarding sensitive data to ensuring smooth operations, our hosts provide a roadmap for staying compliant and secure.

Tune In for the Full Details

For the complete discussion, tune in to episode 198 of the Data Protection Made Easy podcast. Hear real-world examples, actionable advice, and expert insights tailored to help your organisation mitigate risks and thrive during the festive period.

With over 1,400 subscribers, the Data Protection Made Easy podcast is your trusted source for staying ahead in data protection. Subscribe on Spotify, Amazon Music, or your favourite platform to ensure you never miss an episode.

Prepare your organisation for the challenges and opportunities of the festive season with the expert guidance shared in this episode.

GDPR Radio: December’s News Highlights

GDPR Radio: December’s News Highlights

At Data Protection People, our GDPR Radio episodes have become a cornerstone of the Data Protection Made Easy podcast, offering a dynamic platform to explore the latest trends, regulatory updates, and challenges in data protection. In our December episode, hosted on 1st December 2024, we delved into some of the most significant topics in the world of GDPR and data protection, keeping our listeners informed and ahead of the curve.

What is GDPR Radio?

GDPR Radio is more than just a podcast—it’s a community-driven conversation designed to keep businesses, data protection professionals, and enthusiasts informed about the rapidly evolving data protection landscape. Each episode, our expert hosts break down the latest news, provide actionable insights, and tackle pressing questions from our live audience.

This episode featured Philip Brining, Joe Kirk, and Catarina Santos, who brought their unique expertise to the table, ensuring a comprehensive discussion. From regulatory updates to practical compliance advice, this session offered invaluable insights for organisations of all sizes.

What Was Discussed?

During this episode of GDPR Radio, our hosts unpacked:

• Regulatory Developments: Key changes and updates to data protection laws in the UK and EU, helping businesses stay informed and compliant.
• Recent Data Breaches: Analysis of high-profile breaches and the lessons organisations can learn to strengthen their data security measures.
• Industry Trends: Insights into emerging trends in data protection, including how technology and evolving regulations are shaping compliance requirements.
• Interactive Discussions: Listeners joined the conversation, posing their own questions and sharing experiences, fostering a collaborative environment where real-world challenges were addressed.

The Value of Community

At the heart of GDPR Radio is its thriving Data Protection Made Easy community, comprising over 1,400 subscribers from diverse industries. Joining our sessions isn’t just about listening—it’s about engaging with like-minded professionals, sharing insights, and staying connected with the latest in data protection.

As a subscriber, you gain access to:

• Live Episodes: Participate in our live sessions, ask questions, and network with industry professionals.
• On-Demand Access: Catch up on past episodes via Spotify, Amazon Music, or our website resource centre.
• Exclusive Resources: Access templates, tools, and expert guides designed to make data protection simpler and more effective for your organisation.

How to Join the Conversation

Becoming a part of the Data Protection Made Easy community is simple:

1. Visit our website’s events page to explore upcoming topics and register for free.
2. Subscribe to our podcast on your favourite streaming platform to never miss an episode.
3. Engage with us on social media, where we regularly share insights, updates, and resources.

Listen Back to the Episode

If you missed this episode of GDPR Radio, don’t worry! You can listen back to the discussion and catch every detail by clicking the Spotify widget below.