I was musing on whether preparation for breach notification might be something to have half an eye on as we do our GDPR review of the asset register? So for each system/process, make a note of how many records could be affected if it were compromised, whether the content was likely to involve risk/serious risk/no risk to rights and freedoms, etc.

Then if the worst were to happen, you'd have at least some of the info needed for the notification process ready to hand.

Any thoughts on whether that might be feasible/useful?

Andrew

--
Andrew Cormack
Chief Regulatory Adviser

T 01235 822302
Skype ancormack
Twitter @Janet_LegReg
Blog https://community.ja.net/blogs/regulatory-developments
orcid.org/0000-0002-8448-2881


Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG

jisc.ac.uk



> -----Original Message-----
> From: This list is for those interested in Data Protection issues [mailto:data-
> [log in to unmask]] On Behalf Of Michael Bacon - Grimbaldus
> Sent: 30 March 2017 15:14
> To: [log in to unmask]
> Subject: Re: What is your system to manage 72 hour data breach reporting?
>
> The thought of allowing anyone other than the DPO (function) to notify the
> ICO of "breaches" brings me out in a cold sweat.
>
> With a major client we have implemented an 18/7 telephone reporting and
> response system, with 24/7 reporting (to vmail) and an email reporting
> system. Reports are handled by experienced staff who are knowledgable
> about the business and notification. In the majority of "breaches" reported
> to date, substantial follow-up and investigation has been required to obtain
> sufficient information to decide (a) whether it is notifiable and (b) to
> complete the notification if so.
>
> At present the assessment process is being run to the point of notification,
> with a go/no go decision taken within 72 hours. It's giving confidence that
> breaches reported to the DPO function can be notified to the ICO within 72
> hours with the required information.
>
> On 30 Mar 2017, at 13:39, Lawrence Serewicz <00000e347d917fe1-dmarc-
> [log in to unmask] <mailto:00000e347d917fe1-dmarc-
> [log in to unmask]> > wrote:
>
>
>
> Dear All,
>
> I am after some comparative information about the 72 hour reporting
> process. What are you doing to manage the reporting, assessing, and
> notification?
>
>
>
> Are you
>
>
>
> A) Developing a bespoke system to allow staff to upload with pre-
> set criteria, to triage the breach, that notifies the relevant staff who then
> assess notify the ICO?
>
>
>
> B) Relying on Email to the relevant data protection lead
>
>
>
> C) Buying an off the shelf system for staff to report breaches
>
>
>
> D) Something else (please indicate)
>
>
>
> E) Had not thought about it yet.
>
>
>
> Thanks
>
>
>
> Lawrence
>
>
>
>
>
>
>
> Lawrence Serewicz
>
> Information and Records Manager
>
> Transformation and Partnerships
>
> Durham County Council
>
> County Hall
>
> Room 143-148 4th Floor
>
> Durham
>
> County Durham
>
> DH1 5UF
>
>
>
> Direct 03000 268 038
>
> Switchboard 03000 26 0000
>
>
>
> www.durham.gov.uk <http://www.durham.gov.uk>
>
> Follow us on Twitter @durhamcouncil
>
> Like us at facebook.com/durhamcouncil
> <http://facebook.com/durhamcouncil>
>
> Follow us on linkedin.com/company/durham-county-council
> <http://linkedin.com/company/durham-county-council>


^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at https://www.jiscmail.ac.uk/help/subscribers/subscribercommands.html
Any queries about sending or receiving messages please send to the list owner
[log in to unmask]
Full help Desk - please email [log in to unmask] describing your needs
To receive these emails in HTML format send the command:
SET data-protection HTML to [log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^