Website incidents and breach-notification responsibilities

Definition

Notification duties can arise after incidents involving personal information. The trigger, affected data, recipients and deadlines depend on the applicable law. Every US state has a breach-notification law, and the EU and UK set notification rules under the GDPR.

Does it apply to you

• You hold personal information about residents of a state. State definitions of covered personal information differ, so check which of your data falls within them.
• An incident meets that state’s definition of a breach. The definitions differ, particularly on whether encrypted data counts and on whether a risk-of-harm assessment can excuse notice.

Why it matters

An incident-response plan should identify the data involved, the responsible contacts and the process for assessing notification duties. Affected people may be in more than one jurisdiction, so legal review can be needed promptly.

Requirements

• Knowing what personal information you hold and where, before an incident, because that determines who you notify.
• Detecting an incident at all. A duty that starts when you become aware is a duty nobody can discharge without monitoring.
• Notifying within the applicable window, with the content each jurisdiction requires.
• Under GDPR Article 33, a controller notifies the supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to people's rights and freedoms. A notification made after 72 hours must give the reasons for the delay.
• Under Article 34, the controller also tells the affected people without undue delay when the breach is likely to result in a high risk to their rights and freedoms. That is not required if the data was protected, for example by encryption, if later measures mean the high risk is no longer likely, or if it would take disproportionate effort, in which case a public communication is made.
• Under Article 33(2), a processor notifies the controller without undue delay after becoming aware of a breach.

Steadwatch's role

• We document the platform-held data and its retention settings, monitor the managed services and follow the incident-notification terms in the agreement.
• The inventory includes the relevant forms, logs and operational records.

Records you receive

• A current inventory of what the site holds and for how long.
• Data processing terms in the agreement, including breach notification. A separately signed data processing agreement is available on written request on the Business plan.

Your responsibilities

• Notifying affected people and regulators. That is the controller obligation and it stays with you.
• Personal information you hold elsewhere, which is usually the larger part of the inventory.