What is a data breach?
According to the GDPR, a “data breach” means a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access to personal data transmitted, stored, or otherwise processed. A breach is not the end of the world; it simply happens. For example, in 2020, the Polish Data Protection Authority received 7,507 reports of breaches, which most often involved sending correspondence containing personal data to the wrong recipient, disclosing data to an unauthorized person, such as by issuing documents to the wrong individual, or unauthorized access to information due to a programming error.
Remember!
personal data includes any information about an identified or identifiable natural person, not just name, surname, and PESEL.
It also includes, for example, data about a person's location or the history of websites they have visited.
What to do if you suspect a breach has occurred but you don’t know what to do
It may happen that you work in a small organization that has not yet practiced data protection procedures or does not have any at all. This is not the end of the world. Find out if your organization has a Data Protection Officer and contact them – they will certainly handle the matter. If there is no such person or any other designated individual for data protection matters, report the issue to your direct supervisor, the company lawyer, and the IT specialist. Inform them of all circumstances surrounding the incident, even those you are not 100% sure are relevant to clarifying the matter. If none of the aforementioned individuals respond to your information – be brave, contact senior management. Remember, you are acting in the interest of the entire company!
Secure any evidence you can gather
If something strange is happening on your computer screen, for example, you suddenly do not have access to certain data or you have access to too much data, you see documents in the recycle bin (this may not yet be a breach, but it is close) or you see a mysterious participant in a video conference, try to preserve evidence, such as photos or screenshots, to later provide to those investigating the breach.
At the same time, think twice before sharing any data you process at work with anyone outside the organization. If you haven't done so before, ask your supervisor if you are indeed allowed to do so. Is an important person you don't know calling from your company's parent company asking for the phone number of the sales director? Do not provide it immediately; ask for their patience, say that you will call back shortly, and relay this request to your supervisor. Who knows, it might be the sales director's ex-wife calling to confirm his promotion and demanding higher alimony? You never know :)
