A data breach refers to an incident exposing personal data in an
organization’s possession or under its control to the risks of unauthorized
access, collection, use, disclosure, copying, modification, disposal or
similar risks. Data breaches often lead to financial losses and a loss of
consumer trust for the organisation.
It is important for organisations to be accountable towards individuals to by preventing and managing data breaches through data breach assessment. This Guide is intended to help organisations manage data breaches effectively.
Data breaches can occur due to various reasons, such as malicious
activity, human error or computer system error. It is important for organisations to put in place measures which allow them to monitor and take preemptive actions before data breaches occur.
Planning data breach assessment is best done early. Organisations that do not have a data breach assessment plan in place will find it chaotic and challenging when faced with an actual data breach. Having in place a robust data breach assessment plan helps organisations to manage and respond to data breaches more effectively.
Staff should report all suspected/confirmed data breaches to a specific individual or individuals, with expertise in handling personal data and data breaches immediately.
Data breach management team should conduct an initial assessment of the data breach to assess the severity. This should include the following:
Act swiftly to contain the breach (i.e. taking immediate steps to limit any further access to or disclosure of the personal data). Record the data breach and the organization’s response(s) in an Incident Record Log.
Data Intermediaries should report data breaches to the main organization without undue delay (no later than 24 hours) from the time it first becomes aware of the breach.
An in-depth assessment of the data breach can help an organisation understand the risks posed by the data breach and how these risks can be addressed. When assessing the breach, consider the following:
When evaluating risks posed by the data breach, consider the following:
NOTIFY THE PDPC when significant harm or impact is likely or 500 or more individuals affected. Organizations should notify the PDPC as soon as practicable, no later than 72 hours from the time the organization has made its assessment. Organizations may send an email to notify the PDPC of the data breach.
NOTIFY AFFECTED INDIVIDUALS when significant harm or impact is likely Organizations should also notify affected individuals as soon as practicable. Notifications should include (but not be limited to) the following:
Review and take action to prevent future breaches. This may include the following:
Having in place a data breach management plan is important as it will
enable organisations to respond swiftly in managing any data breaches
in a systematic manner. Organisations are encouraged to proactively
develop and implement a robust data breach management and response
plan, and to review the plan regularly to ensure it remains effective and
relevant as business operations evolve.
Established in 2018, Privacy Ninja is a Singapore-based IT security company specialising in data protection and cybersecurity solutions for businesses. We offer services like vulnerability assessments, penetration testing, and outsourced Data Protection Officer support, helping organisations comply with regulations and safeguard their data.
Singapore
7 Temasek Boulevard,
#12-07, Suntec Tower One,
Singapore 038987
