Personal Data Breach: How to Respond Effectively to Data Subject Requests
DPO Consulting Joins Grant Thornton
Notifying the supervisory authority and informing affected individuals does not mark the end of a personal data breach response process. In the days that follow, the DPO, legal department, customer relations team or support services may receive a variety of requests: understanding what happened, identifying which data was affected, requesting erasure or seeking compensation.
Each situation should be assessed on a case-by-case basis to provide a clear, consistent and transparent response without disclosing information that could undermine system security or an ongoing investigation.
The best time to prepare is before requests begin to arrive.
A small coordination team involving the DPO, legal department, security team and customer relations department, supported by a short validation process and common messaging, makes responses more efficient.
The response period is generally one month from receipt of the request. It may be extended by a further two months when requests are complex or numerous, provided the individual is informed within the initial time limit, in accordance with Article 12(3) GDPR.
A register tracking requests and deadlines can help prevent omissions.
It should also be noted that data breaches often generate phishing attempts. Where there is doubt regarding the requester’s identity, it may be verified without requesting more information than necessary.
Even after being informed of the categories of data affected, individuals frequently ask which data was compromised, how long it was exposed and who may have accessed it.
These questions may fall within the scope of the right of access under Article 15 GDPR.
However, not everything can be disclosed. The attack methodology, exploited vulnerabilities or details relating to an ongoing investigation should not generally be shared. Organizations should remain transparent about the individual’s data without compromising system security or legal proceedings.
Some individuals simply want to know whether their personal data are involved.
Following a proportionate identity verification process, the organization should determine whether the individual appears in the affected datasets and specify the categories of exposed data, identified risks and recommended precautions.
For example, if an insured individual asks whether their bank account details were compromised while only their name, address and contract number were exposed, the response should clearly confirm this and highlight relevant risks, particularly phishing attempts.
This question often comes from former customers, policyholders or employees who discover that their personal data were still included within the scope of the incident.
The organization should verify whether retention was justified by a legal obligation, intermediate archiving requirements or a statutory limitation period.
If retention was justified, the legal basis and retention period should be explained in simple terms.
If not, the organization should acknowledge the issue, delete the data where possible and correct the retention process.
A compensation claim, whether submitted alongside an access, erasure or information request, should be recorded with all supporting documentation and forwarded promptly to the legal department.
It may initially be classified as a compensation claim or pre-litigation matter. It only becomes contentious when, for example, a formal notice, lawyer involvement or court proceedings occur.
The legal department should assess the existence of the breach, the alleged harm and the causal link between them, with support from the DPO, relevant teams and, where necessary, processors.
Under Article 82 GDPR, compensation requires actual material or non-material damage. Concerns or anxiety may be considered where they are concrete and adequately substantiated.
Pending that assessment, the organization should simply acknowledge receipt of the request without admitting liability or committing to compensation and determine whether notification to its insurer is required.
Following an incident, many individuals request the immediate deletion of their personal data pursuant to Article 17 GDPR.
Deletion may be possible, but the data controller must retain information necessary to comply with legal obligations, establish or defend legal claims or document the incident within its breach register, in accordance with Articles 17(3) and 33(5) GDPR.
The appropriate response should therefore explain what data will be deleted, what data will be retained, why and for how long.
A data breach tests not only the security of an information system but also an organization’s ability to demonstrate accountability. When managed effectively, these requests can help rebuild trust.
Key points to remember include:
Looking to strengthen your personal data breach response procedures or improve GDPR compliance? DPO Consulting’s experts can support you in designing robust governance and incident management frameworks.
Learn more about our expertise: https://www.dpo-consulting.com/contact-us
.svg)
.png)
