Data Breach Training

What the training consists of

1. 

   1. What is a data breach

   2:25

   To begin, colleagues learn that a personal data breach is a breach of security that leaves personal data destroyed, lost, altered, disclosed or accessed without authorisation. The lesson also shows what a breach can mean for the people the data is about.

2. 

   2. Identification of data breaches

   1:50

   Phishing, hacking, people inside the organisation, simple mistakes and stolen devices can all lead to a breach. From there, the second lesson turns to the warning signs that a breach may be under way.

3. 

   3. Responding to data breaches

   1:37

   The last lesson covers what to do once a breach is suspected: disconnect the computer from the network, report it to IT, the security team or a manager, and note what happened and which data was involved.

Why it matters

A breach can cost the organisation its customers’ trust and bring legal penalties and financial losses. The GDPR requires the organisation to report significant personal data breaches to the data protection authority within 72 hours and to notify the people affected as soon as possible. Neither is possible for a breach nobody has noticed.

What your colleagues learn

• The harm to people depends on what was exposed. Leaked bank details could lead to identity theft, while leaked health records could result in discrimination when someone applies for a job.
• An email to the wrong person can be a breach. When it contains personal data not meant for the recipient, it counts as unauthorised access, in the same way as someone getting into a customer database.
• Digital breaches can be hard to notice. What gives one away is unusual activity, such as login attempts from unknown locations, or files that appear without being downloaded or go missing.
• The person who spots a breach is not the one who repairs it. Reporting it starts the organisation’s incident response plan, and trying to fix or remove anything could hinder the colleagues who handle the breach.
• Details of a breach stay confidential until sharing them is allowed. Talking about it too early might get in the way of containing it.