GDPR Incident Response Guidelines

Any company that might possibly collect or use data about EU citizens, regardless of the company’s location, must adhere to GDPR guidelines.

Under GDPR, individuals have the right to understand what data will be or has already been collected about them, how that data will be used, and to request that data be deleted.

Failure to comply with GDPR in any way, including how data is collected, used, or stored, can lead to a fine of up to 4% of a company’s annual global turnover.

If any of those trigger events occur, companies must issue a notification under GDPR incident response guidelines.

Organizations must notify the appropriate GDPR supervisory authority within 72 hours after learning about the incident (or include reasons for a delay past that timeframe).

The notification should detail:

• The incident, including the types and amount of data involved and the number of people associated with that data
• Contact information for someone at the company who can share more details (this should usually be the Data Protection Officer, a role required by GDPR)
• Likely consequences from the incident
• Plans to address the incident and reduce any negative effects

If companies do not have all of this information at once, they can provide the details in phases, but the initial notification should still come in the 72 hour window.

If the incident creates a situation that puts the affected individuals at high risk, then organizations must also notify those people as soon as possible. These notifications should clearly describe the incident and the type of information compromised.

GDPR sets deadlines of “without undue delay” for these notifications, which some interpret as 72 hours (the timeline used in other parts of the regulation) while others believe this part of the regulation is more tolerant of a wider timeframe. Either way, organizations should not delay, as courts have ruled in prior judgements that the deadline is “not compatible with a time limit of several weeks or … several months”.

Organizations do not need to send these individual notifications if:

1. The compromised data is protected in a way that renders it unusable to any attackers (for example, if it’s encrypted and therefore unreadable).
2. The organization has already taken action that will reduce the fallout from the incident so that it no longer threatens individual safety or freedoms.
3. There are too many individuals affected that notifying every one of them would become a big burden, in which case GDPR allows companies to make a public announcement that notifies all of the people on which they have data.

GDPR presents strict guidelines for data privacy, and over €158.5 million in fines has made clear the EU is serious about enforcing these regulations.

This situation makes it absolutely critical for any company that has data about EU citizens to closely monitor GDPR requirements and how they change over time. It also means organizations need a long-term breach response plan. Avoiding an incident altogether is important, but it’s a given that one will occur at some point, and that makes having an actionable, proactive incident response plan non-negotiable.