STARTUPS, WHAT ARE YOUR OBLIGATIONS IN THE EVENT OF A PERSONAL DATA BREACH?
Implementing security measures is an obligation imposed by the RGPD. What is a personal data breach? How to react? What are my obligations as a data controller? What are my obligations when my startup acts as a subcontractor?
The aim of this article is to give you the reflexes you need to adopt in the event of a personal data breach.
1. What is a personal data breach?
A personal data breach corresponds to any action, whether intentional or not, that undermines the confidentiality, integrity, or availability of personal data (Article 33 of the RGPD).
Examples: loss of a document containing personal data, malicious entry into a database.
A security flaw is a broader concept that corresponds to a vulnerability within an information system (IS) that, if exploited, could jeopardize its integrity.
Examples: SQL injection, phishing, ransomware, …
Security breaches do not always affect personal data, and therefore do not always result in a data breach. It is therefore necessary to analyze the data affected by the security flaw.
2. What are your obligations as Data Controller?
The startup acting as data controller must comply with the following obligations:
a. Obligation to notify the supervisory authority
The startup is obliged to notify the competent supervisory authority of any breaches of the data it processes, where there is a risk to the persons concerned.
When to notify? Obligation to notify the supervisory authority within 72 hours of becoming aware of the personal data breach.
Warning: Startups processing personal data of individuals located in France: Link to the CNIL form: https: //notifications.cnil.fr/notifications/index. This CNIL notification form requires you to specify the reasons for the delay. The CNIL requires a new 72-hour period between the initial notification and the additional notification.
b. Obligation to inform data subjects
Where there is a high risk to the rights and freedoms of data subjects, the startup is obliged to communicate the occurrence of a data breach to those concerned.
How soon? This communication to the people concerned must be made as soon as possible.
Communication content:
- Description, in clear and simple terms, of the nature of the personal data breach;
- Name and contact details of data protection officer or other point of contact from whom further information can be obtained;
- Description of the likely consequences of the personal data breach ;
- Description of the measures taken or proposed to be taken by the controller to remedy the personal data breach, including, where appropriate, measures to mitigate any negative consequences.
In some cases, it may be necessary to distinguish between data subjects who need to be informed and data subjects who, because of one of the exceptions below, do not need to be informed if :
- Appropriate technical and organizational protection measures have been taken (e.g. encryption or pseudonymization);
- Subsequent measures ensure that the high risk is no longer likely to recur;
- Communication to the people concerned would require disproportionate effort (in which case public communication would be appropriate).
c. Obligation to keep a register of personal data breaches
The RGPD requires the startup to document any data breach to enable the supervisory authority to carry out an a posteriori check of all personal data breaches. The startup must therefore keep a register of personal data breaches.
When? This register must be kept on an ongoing basis, and the startup must record all data breaches that have occurred.
