A formally worded message tells you that "following a security incident" some of your data may have been exposed. It might come from your mobile operator, a booking platform or a health provider. The first reaction is often confusion. Knowing what the law requires of the company and what you can do turns that notice into a manageable situation.
What a personal data breach is
Article 4 of the GDPR defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. It is not only about cyberattacks. The following are breaches too:
- an email with an attachment containing customer data sent to the wrong recipient;
- an unprotected laptop left on a train;
- a database made unavailable by a failure with no backup copies;
- paper documents thrown in the bin without being shredded.
The company's obligations
Notifying the supervisory authority
Under Article 33 of Regulation (EU) 2016/679, the controller must notify the breach to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. In Italy the competent authority is the Garante per la protezione dei dati personali.
Communicating it to you
Article 34 adds a direct duty towards data subjects. When the breach is likely to result in a high risk to your rights and freedoms, the controller must communicate it to you without undue delay, in clear and plain language. The communication must include at least:
- the nature of the breach;
- the name and contact details of the Data Protection Officer or another contact point;
- the likely consequences;
- the measures taken or proposed to address the breach and mitigate its adverse effects.
The controller is exempt from individual communication in some cases: if the data was protected by measures, such as encryption, that make it unintelligible to anyone not authorised; if it has taken subsequent measures that ensure the high risk is no longer likely to materialise; or if individual communication would involve disproportionate effort, in which case it must use a public communication instead.
Work out which data is involved
Not all breaches carry the same weight. What you need to do depends on the type of data exposed.
| Data exposed | Main risk | What to do |
|---|---|---|
| Email and password | Access to your accounts | Change the password wherever you reused it and turn on two-step verification |
| Name, phone, address | Targeted scams by text, phone or email | Be wary of contacts that quote real details to ask for more |
| Payment details | Unauthorised charges | Alert your bank, check transactions, consider blocking the card |
| Identity document | Identity theft | Keep the notice, watch for credit applications in your name |
| Health data | Exposure of sensitive information | Ask the controller for precise details of the breach's extent |
Steps to take right away
- Check the notice is genuine. Criminals exploit news of breaches to send fake messages. Do not click on links: reach the service by typing the address yourself or using the official app.
- Change the credentials involved. If the password was also used for other services, change it there too.
- Stay extra alert in the following weeks. A call from a supposed operator who knows your name and address is not trustworthy just because of that.
- Keep all the paperwork. The notice, later emails and any anomaly you notice may be useful later on.
Which information you can demand
If the communication you received is vague, you can exercise the right of access under Article 15 to find out exactly which of your data was involved, to whom it may have been disclosed and which measures have been taken. Ask precise questions: "which categories of my personal data were held in the breached database?" works better than a generic "please explain".
Complaint and compensation
If you believe the company did not adequately protect the data or did not inform you when it should have, you can lodge a complaint with the supervisory authority under Article 77 GDPR. Independently of the complaint, Article 82 gives anyone who suffers material or non-material damage as a result of an infringement of the Regulation the right to compensation from the controller. To obtain it you will need to show the concrete harm suffered: charges, expenses, time lost, documented inconvenience.
In short
- A data breach is not only a cyberattack: a misdirected email or a lost document counts too.
- The company must notify the supervisory authority within 72 hours where feasible and tell you directly if the risk is high.
- What you need to do depends on the data exposed: credentials, contact details, payments or documents.
- Be wary of messages exploiting the news of the breach and do not click on links.
- You can request details through the right of access, lodge a complaint and claim compensation for damage.