7-Steps to dealing with a data breach

First 24 hours breach response checklist

During the first 24 hours after a data breach has been discovered, you should do the following:

• Document the date and time of breach
• Assess the scale and severity of the breach and whether it was caused by a cyberattack or employee error. Investigate what data has been accessed and is potentially at risk of exposure
• Establish which areas of the business have been affected
• Ensure the incident response team have been notified
• Understand whether a risk assessment has been conducted and whether your company followed due diligence after discovering the data breach.

Every data breach carries a different level of severity and there are scenarios where it is not possible for businesses to mitigate the risk. For example, in the case of zero-day vulnerabilities, the average business’s expertise and budget can make these extremely difficult, if not impossible to find given that until the vendor is made aware of a breach, there is no way to tell if your business is at risk. In this scenario, an effective data loss prevention strategy includes the use of firewalls, keeping operating systems and software up to date and implementing staff training to reduce the risk of human error contributing to a breach.

After discovering a data breach, organizations also need to follow an incident response process that is consistent and repeatable, with a focus on documenting insights into the attack and following a triage process. This is vital to assess how the data breach may have occurred, what type of attack it is, what systems have been affected and what data has been stolen, leaked or shared.

Who to notify after a data breach?

In many cases, businesses are required to notify key governing bodies such as the Information Commissioner’s Office (ICO) when they experience a data breach, and depending on the level of risk, the ICO must also be informed within 72 hours from the time the breach was discovered. For example, if the breach involves personal data, the 72-hour rule applies even if there is limited information available about the extent of the attack. It is therefore vital that businesses understand the type of breach they are dealing with so they can take the correct action.

When to inform the ICO of a data breach

While businesses are not required to report every breach to the Information Commissioners Office, there are several circumstances under which the ICO must be notified if businesses believe that they have experienced one of the following data breaches:

• A personal data breach under the GDPR or the DPA Act 2018
• A PECR security breach – a breach of any telecom or internet service provider
• NIS (Network and Information Systems) incident – a data breach of any organization that provides digital services to the public including online search engines, cloud services, and online marketplaces
• eIDAS (Electronic Identification and Trust Services) breach – a security breach of any organization under the eIDAS regulation that handles the electronic verification of an individual or business’ identity and verifying the authentication of electronic documents (electronic signatures and timestamps, for example)

It’s worth remembering an organization may initially suffer a systems breach which only disrupts their network service. The ICO would need to be notified of a cyber incident like this under the NIS regulation. Personal data breaches can be a consequence of a NIS attack therefore the ICO must be informed of the breach under the UK GDPR.