Answer
A data breach occurs when the data for which your company/organisation is responsible suffers a security incident resulting in a breach of confidentiality, availability or integrity. If that occurs, and it is likely that the breach poses a risk to an individual’s rights and freedoms, your company/organisation has to notify the supervisory authority without undue delay, and at the latest within 72 hours after having become aware of the breach. If your company/organisation is a data processor it must notify every data breach to the data controller.
If the data breach poses a high risk to those individuals affected then they should all also be informed, unless there are effective technical and organisational protection measures that have been put in place, or other measures that ensure that the risk is no longer likely to materialise.
As an organisation it is vital to implement appropriate technical and organisational measures to avoid possible data breaches.
Examples
Organisation must notify the DPA and individuals
The data of a textile company’s employees has been disclosed. The data included the personal addresses, family composition, monthly salary and medical claims of each employee. In that case, the textile company must inform the supervisory authority of the breach. Since the personal data includes sensitive data, such as health data, the company has to notify the employees as well.
A hospital employee decides to copy patients’ details onto a CD and publishes them online. The hospital finds out a few days later. As soon as the hospital finds out, it has 72 hours to inform the supervisory authority and, since the personal details contain sensitive information such as whether a patient has cancer, is pregnant, etc., it has to inform the patients as well. In that case, there would be doubts about whether the hospital has implemented appropriate technical and organisational protection measures. If it had indeed implemented appropriate protection measures (for example encrypting the data), a material risk would be unlikely and it could be exempt from notifying the patients.
Company must notify clients and they may then have to notify the DPA and individuals
A cloud service loses several hard drives containing personal data belonging to several of its clients. It has to notify those clients as soon as it becomes aware of the breach. Its clients must notify the DPA and the individuals depending on the data that was processed by the data processor.