Last week, I received an email from my local council to say that there had been a data breach.
The breach was an email that had been sent out with the email addresses in copy – not blind copy.
This was, in their words “an unfortunate incident caused by human error” – and most breaches are. Whether its failing to put email addresses in blind copy, sending letters to the wrong address or losing files – you can't stop people making mistakes!
And if you can't prevent human error, then you need to know what you have to do when mistakes are made.
Of course it’s very easy to put this on the to do list, but I would urge you to think about the process now so you don’t have to panic when a breach occurs.
To help you, here’s my easy 5R process:
- Recognise: you find out that you’ve had a breach of data. You will need to gather all the details of the breach: how, what, when and who.
- Respond: you investigate the breach to understand what the likely impact of the loss of information has on your customers and contacts. Depending on the severity, you will need to get in touch with your customers and, potentially, report the breach to the ICO.
- Review: check your current systems and security, what needs to change to prevent another breach? Training of employees, an increase in data security?
- Record: you need to keep a record of any personal data breaches, regardless of whether you are required to notify the relevant authority or your customers.
- Readiness: stay alert to any future incidents. Regularly check access levels to your data, ensure all new employees are trained in data awareness, keep malware and anti-virus up to date and carry out a full information audit at least once a year.
If that still feels like too much, then I’d be happy to help you. I can promise you a pain-free GDPR experience! Just get in touch for a free call.