I hate losing things – as a precocious teenager, I had the most precious earrings – probably only from Miss Selfridge or Top Shop but thought they were the bee’s knees.  Tiny silver fans with dangling tassels.  I’d not had my ears pierced for long and they were one of the first fashion pairs of earrings I had.  We’re talking the 80s here – so hope that paints a picture for you!

Getting home one night after a date at the cinema, I realised I’d lost one.  So next morning, I dragged my little sister
out to search.  We went on the bus all
the way to the centre of town and spent what felt like ages fruitlessly
searching for that precious earring. 

Losing things always upsets me – I hate the fact that there’s something
of mine adrift in the world!

It’s the same with business data – how awful would it be for your
business if you lost your precious data or someone got hold of it without your
permission?

All businesses collect data even if it’s just the contact information
of their clients.  In fact, many small
businesses collect data without realising and then don’t do anything with it –
but that’s for another time.

There have been a number of high-profile data breaches in the press in
the last couple of weeks.  EasyJet had 9
million customer email addresses stolen as well as the card details of over
2,000 customers.  And in Northern
Ireland, 250 survivors of institutional abuse were identified when a newsletter
was emailed out without their names being anonymised.

The first is a case of cybercrime and the second human error, but both
are a data breach and were reported to the Information Commissioner’s Office.  Both have put the rights and freedoms of
those individuals at risk and have caused distress, financial worry and
feelings of violation.

These are both very high-profile cases, but what happens in your
business – do you understand what a data breach is and if you need to let your
customers or the ICO know?

The guidance in the GDPR is very clear. 
The Regulations state that certain types of personal data breach must be
reported, where feasible, within 72 hours of becoming aware of the breach.  And you need to know what certain types of
breach must be reported and to whom.

So what is a breach?  It’s the
loss of information that puts the rights and freedoms of individuals at risk
whether it’s accidental or deliberately unlawful.  Rights and freedoms here means emotional
distress, physical and material damage.

To know that your business has suffered a breach whether by a hacker,
disgruntled employee or just by a simple mistake, you need to make sure that
you have a robust breach detection and internal reporting systems in place, as
well as the obvious, knowing where that data is and who has access to it.

Put simply:

• Recognise: you find out that you’ve had a breach
  of data.  You will need to gather all the
  details of the breach: how, what, when and who.
• Respond: you investigate the breach to understand
  what the likely impact of the loss of information has on your customers and
  contacts.  Depending on the severity, you
  will need to get in touch with your customers and, potentially, report the
  breach to the ICO.
• Review: check your current systems and security,
  what needs to change to prevent another breach? 
  Training of employees, an increase in data security?
• Record: you need to keep a record of any
  personal data breaches, regardless of whether you are required to notify the
  relevant authority or your customers.
• Readiness: stay alert to any future incidents.  Regularly check access levels to your data, ensure
  all new employees are trained in data awareness, keep malware and anti-virus up
  to date and carry out a full information audit at least once a year.

If you have the right systems in place, a loss of data should be a very
rare event, but two final pieces of advice. 
Firstly, don’t assume your systems are impenetrable and secondly – make sure
you really know where your data is and who has access to it!

If you’re not sure about those two final points, please get in touch –
we’d be happy to help you keep your customer and business information safe.