Lost laptops, misaddressed emails, a compromised account, an attack on a database: data security breaches are not exceptions but operational reality. What matters is how quickly and orderly a company responds. The notification duties set the frame.
What a breach is
A data security breach occurs when personal data is accidentally or unlawfully lost, deleted, destroyed or altered, or disclosed or made accessible to unauthorised persons. Unavailability also counts, for example through encryption in a ransomware attack. Not every incident must be reported; but every incident must be assessed and documented.
Switzerland: notifying the FDPIC
Under Article 24 of the revised FADP, the controller notifies the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible of a breach likely to result in a high risk to the personality or fundamental rights of the persons concerned. The notification states at least the nature of the breach, its consequences where possible and the measures taken or planned. The persons concerned must be informed if necessary for their protection or if the FDPIC requests it. Processors notify the controller of every breach as soon as possible.
EU: 72 hours
Where the GDPR applies, the breach must be notified to the competent supervisory authority where feasible within 72 hours of becoming aware, unless it is unlikely to result in a risk (Art. 33). Where a high risk is likely, data subjects must be informed without undue delay (Art. 34). Incomplete information may be supplied in stages. Swiss companies subject to the GDPR may therefore have to make two notifications against different standards.
The risk assessment
The core question is the risk to the persons concerned, not to the company. Relevant are the type and volume of data, whether special categories are involved, whether the data was encrypted or pseudonymised, who gained access and which consequences threaten, such as identity theft, fraud or reputational harm. Encrypted data with a secure key lowers the risk considerably; that is one of the strongest reasons for encryption at rest.
Preparation is half the notification
Those who only clarify during the incident who decides, who reports and who communicates lose the time the deadlines do not allow. A prepared process with roles, templates and contacts is part of the organisational measures. Our checklist for the first 72 hours describes the steps with verifiable criteria.