Personal data breaches

The European Data Protection Board’s (EDPB) guidelines contain more examples, as well as guidance on how different types of personal data breaches should be handled.

Guidelines 01/2021 on Examples regarding Personal Data Breach Notification

Data subjects can suffer serious consequences

A personal data breach may pose risks to the freedoms and rights of data subjects and may lead to serious consequences, such as:

• financial loss
• discrimination
• identity theft
• fraud
• damage to reputation

Act quickly and report certain personal data breaches

The General Data Protection Regulation (GDPR) requires you, as the data controller, to act quickly when a personal data breach has occurred. You must prioritise the investigation of personal data breaches and set aside sufficient resources for this work.

As a data controller, you must assess the risks of the breach affecting the rights and freedoms of data subjects and maintain documentation of any personal data breaches that occur.

You must report the breach if it is not unlikely that the personal data breach poses a risk to the rights and freedoms of natural persons. As a general rule, a notification must be made within 72 hours of you becoming aware of the personal data breach.

If the personal data breach is likely to pose a high risk to the rights and freedoms of natural persons, the general rule is that you, as the data controller, must inform the data subjects of the personal data breach. You must provide this information to the data subjects without undue delay.

Cross-border personal data breaches

A personal data breach may involve several EU Member States. Such breaches must be reported to the supervisory authority that you, as the data controller, have assessed as being the competent supervisory authority.

Before you start a new processing of personal data, it is therefore important that you determine which authority will be your competent supervisory authority, so that you know which authority to contact if a personal data breach occurs.

To determine which authority is the competent supervisory authority, you should base your assessment on where your main or sole place of business is located.

Work in a risk-aware and preventative manner

To avoid personal data breaches and minimise their impact, it is important to work in a risk-aware and proactive manner. You can read more about this on the information security page below.

You must be prepared for the possibility of data breaches and have procedures in place to deal with them as quickly and effectively as possible. It is important to take preventative measures, for example by

• creating clear routines to easily detect personal data breaches,
• developing an action plan for how your organisation will handle personal data breaches,
• involving the data protection officer in the handling of personal data breaches,
• documenting all personal data breaches and assessing the potential risks of new breaches.

Information security

If you have appointed a data processor

If you appoint a data processor and a personal data breach occurs with the data processor, the data processor must report it to you without undue delay.  As the data controller, you are always responsible for reporting the personal data breach to the supervisory authority.

The data processor's obligations (in Swedish)