What a data breach is
In privacy and security rules, a data breach generally means that personal information has been accessed, disclosed, lost or altered without authorization. The cause may be an outside attack, a stolen laptop, a misconfigured storage setting, a mistaken email or a staff member misusing access. Not every security incident is a breach of personal data. An attack that disrupts a service without exposing personal information may be handled under different rules.
This article is general information, not legal or compliance advice. Requirements differ by place, sector and situation, and organizations should consult qualified professionals.
Why many places require notification
Breach notification laws spread because of a simple problem: for a long time, organizations had little reason to tell anyone when information was exposed. Individuals could not protect themselves against risks they did not know about, and regulators and the public could not see how common or serious incidents were.
Several arguments support a notice requirement:
- Self-protection. People told promptly can change passwords, watch accounts, place alerts or be alert to scams that use the stolen details.
- Accountability. Having to disclose publicly or to a regulator gives organizations a reason to invest in security and to handle incidents carefully.
- Information for regulators and researchers. Reports reveal patterns across industries.
- Fairness. The organization holding the data is usually in a better position to know what happened than the people affected.
In the United States, state-level laws began appearing in the early 2000s, and eventually most states had one. Other regions use national or regional laws, such as the European Union’s General Data Protection Regulation, which includes breach reporting provisions. The result is a mix of rules that differ in detail.
Common elements of notification rules
The specifics vary, but several features appear often.
A trigger
Most laws define what counts. Some apply to any unauthorized access to personal data. Others require notice only where there is a risk of harm, or where specific kinds of data, such as financial account numbers or government identifiers, are involved. Data that was properly encrypted may be exempt in some laws, on the reasoning that scrambled data is not readable by whoever took it. The definition of personal data used in the relevant law therefore affects what is covered.
Who must be told
Typically some combination of:
- Regulators or authorities, such as a data protection authority or an attorney general’s office.
- Affected individuals.
- Other parties, which may include credit reporting agencies in cases of large incidents, business partners or customers whose data a service provider held.
Where a vendor holds data on behalf of another organization, contracts and laws usually require the vendor to alert the organization that owns the relationship, which then decides on onward notices. Cloud arrangements make it important to understand who is responsible for what, which links to the shared responsibility model.
Timing
Deadlines range widely. Some laws say “without unreasonable delay.” Others set specific time limits. The European Union’s general rule, for example, expects organizations to notify the supervisory authority where feasible within 72 hours of becoming aware of a breach that is likely to result in risk to people, while notice to individuals is required where the risk is high. Some laws allow delays when law enforcement asks for them or when an organization needs time to determine the scope. Because the clock may start when the organization becomes aware, the speed of detection matters.
Content
A notice typically explains, in plain language:
- what happened and when, as far as is known
- what types of information were involved
- what the organization is doing in response
- what steps affected people can take
- who to contact for questions
Some laws list required contents, and some require offering a service such as credit monitoring in certain situations.
Enforcement
Failure to notify, or notifying late, can lead to regulatory action, fines or private lawsuits, depending on the jurisdiction. Penalties vary greatly.
What organizations typically do in practice
Notification is one step within a broader response. Organizations often work through a sequence like this:
- Detect and contain. Identify the incident and stop further exposure.
- Assess. Work out what data was involved, how many people, and whether the information was protected, for example by encryption.
- Determine legal duties. Identify which laws apply, based on where affected people live and where the organization operates, which is often more than one place.
- Notify. Inform the relevant authorities and individuals within the required time, using clear language.
- Support and review. Answer questions, offer assistance where appropriate and fix underlying weaknesses.
Having a documented incident response plan in advance makes this much less chaotic, because deciding who does what during a crisis is difficult. Good record-keeping about data held, aided by data governance and sensible data retention practices, makes it faster to know who is affected, and holding less data in the first place reduces how many people are affected, a core idea of data minimization.
Criticisms and debates
Notification requirements are widely accepted, but they are not free of controversy.
- Notice fatigue. If people receive many letters, they may stop paying attention. Over-notifying about trivial risks may make serious notices less effective.
- Thresholds. Deciding when harm is “likely” is a judgment call, and organizations have an incentive to conclude it is not. Critics worry about under-reporting; supporters of risk-based triggers worry about needless alarm.
- Patchwork compliance. Organizations operating in multiple places face different definitions and deadlines, which can be burdensome, especially for small ones.
- Limited benefit for individuals. The steps available to a person, such as freezing credit or changing passwords, may not undo the harm, and notice does not by itself compensate anyone.
- Pressure on timing. Tight deadlines can force announcements before facts are known, risking incomplete or later-corrected statements.
What to do if you receive a breach notice
Notices can be real or can be imitations used by scammers, so be careful. Rather than clicking links in an unexpected message, you can usually contact the organization using details from its official website. General steps people often consider include changing passwords for affected accounts and anywhere the same password was used, turning on multi-factor authentication, reviewing account statements, and being wary of follow-up phishing scams that mention the breach. Specific recommendations depend on what data was exposed, and the notice itself often includes guidance.
Key takeaway
Breach notification rules rest on the idea that people should be able to protect themselves, and organizations should be accountable when protection fails. How, when and to whom notice must be given varies by place, and anyone responsible for an organization’s data should seek qualified advice on their obligations.