Reporting A Data Breach

What is a Data Breach?
Conventionally, people think of hackers, who use complex tools to access company systems and extract data, in relation to a breach. However, any unauthorized access to your company’s data may constitute a breach. Some examples include:

• Employees leaving the company with sensitive information and no prior authorization.
• A database with personal information of customers being available publicly (with no prior consent of customers)
• Emailing company or customer information to the wrong party
• Unauthorized access by cyber threat actors (aka hackers), who exfiltrate data and use it wrongfully with no consent from the company or its customers.

Notice that some breaches relate to company information, while others to personal data. You have an obligation to report both.

How can I report a data breach, and to whom should I report this?
Please note, based on your country of operation, reporting a data breach may be legally mandatory. The best ways to be sure of your responsibilities are to:

• Refer to the cyber laws of the countries your company has operations in
• Check with your IT team or your Company’s Data Protection Officer (DPO)
• Visit the regulatory authority’s – typically Personal Data Protection Commission (PDPC) or its equivalent – website to learn of your responsibilities. Example – A tool like this, from the Singapore Government’s PDPC, is a relevant reference.

Generally, authorities get involved when the personal information of individuals is compromised. The best first step is to escalate any breach internally to your Management, who can then decide on appropriate next steps.