What is a data breach?
A personal data breach is the breach of security which results in accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Breaches can be both accidental or deliberate actions. So a breach is more than just about losing personal data, and can include sharing or access by an unauthorised third party.
How do I know if my Company’s ‘personal’ information has been shared?
One of our clients is offering a free Dark Web Scan for businesses that we work with. This is a service that monitors the company domain and IP addresses in use on the darker sides of the internet. Any mention of credentials, or data being bought or sold are identified. If the domain name has been caught up anywhere in a data breach (including supplier chain) or is being discussed, this too is identified. Each of these instances are then delivered for review.
The file will contain a lot of areas, including most of the time the source, any personally identifiable information and where its appropriate the email address and password in use to help identify if the data is current.
Put simply, its used as an early warning service and helps to identify any data breaches and possible incidents for a business. If you are a business providing professional services or processing other peoples data, you can book your scan here. Please use the initials RHR after your surname to indicate you are on our mailing list.
How do I report a breach?
First of all, you don’t need to report all data breaches. If you are not sure you can use this Self Assessment for Data Breaches to work out whether this poses a risk to people and the likelihood and severity of the risk to people’s rights and freedoms, following the breach. If it’s likely there will be a risk then you must notify the Information Commissioner’s Office; where it’s unlikely you don’t need to report it.
The ICO’s helpline offers advice about what to do in the event of a breach, including how to contain it and how to stop it happening again. They can also offer advice about whether you need to tell the data subjects involved.
If you are interested in GDPR, check out our article on higher standards of protection around health information.