How to manage a personal data breach
Published by a LexisNexis Risk & Compliance expert
Practice notesHow to manage a personal data breach
Published by a LexisNexis Risk & Compliance expert
Practice notesData security is a cornerstone of the UK General Data Protection Regulation (UK GDPR). The sixth data protection principle (the integrity and confidentiality principle) requires you to take appropriate technical and organisational measures to process personal data in a manner that ensures appropriate security, including:
- •
protection against unauthorised or unlawful processing
- •
accidental loss, destruction or damage
This Practice Note reflects ICO guidance on personal data breaches under the UK GDPR. It also contains additional useful practical information set out in ICO guidance on data security breach management issued under the previous data protection regime. This guidance has now been withdrawn.
This Practice Note also reflects guidance issued by the European Data Protection Board (EDPB). According to the ICO, although the UK has left the EU, these guidelines continue to be relevant.
Data security requirements
Article 32 puts more flesh on the bones of the GDPR’s integrity and confidentiality principle. You are required to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk,
Access this content for free with a 7 day trial of LexisNexis and benefit from:
- Instant clarification on points of law
- Smart search
- Workflow tools
- 42 practice areas
Get your quote today and take step closer to being able to benefit from:
- Instant clarification on points of law
- Smart search
- Workflow tools
- 36 practice areas
Get a LexisNexis quote
* denotes a required field
To view the latest version of this document and thousands of others like it,
sign-in with LexisNexis or register for a free trial.
Powered by Lexis+®
Jurisdiction(s):
United Kingdom
Key definition:
Personal data definition
What does Personal data mean?
Personal data means data relating to a living individual who can be identified from such data, either alone or with other information in the data controller’s possession. It includes opinions about, and intentions in relation to the data subject.
CONTACT US
