Module 4 · Chapter 9

Personal Data Breaches and the 72-Hour Deadline

When a supplier’s fault shows data to the wrong people, short deadlines start. This chapter shows who must tell whom, how fast, and who decides whether the people affected hear of it.

≈ 7 min read 8-question test

In this chapter

  • What counts as a personal data breach, with or without a hacker
  • Who must tell whom after a breach, and how fast
  • How the customer decides which people to tell, and why

9.1Breaches in one paragraph

A breach happens when a security failure loses personal data or puts it in the wrong hands. Then short deadlines start. Tennerby must tell Corrandale fast, and Corrandale then decides who else is told. This chapter follows one fault in a new release through those steps.

Key point

Tennerby tells Corrandale within 24 hours, and Corrandale decides who else is told. The deadline to report to the ICO is Corrandale’s, not Tennerby’s.

Also in this chapter

  1. What counts as a personal data breach
  2. Who tells whom, and how fast
  3. The first notice, and reporting in stages
  4. Telling the care workers: high risk only
  5. Your job

Preview

The rest of this chapter opens with a free account. Every edition is free to read until 31 January. Open a free account by the end of that day and keep every edition published by then, for good. Open it from the edition home →