What reduces a GDPR fine after a data breach?
Mostly what you did before and after: prompt notification, real mitigation and cooperation. Article 83(2) of the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679). lists the factors authorities weigh, including the nature, gravity and duration of the infringement, whether it was intentional or negligent, the action taken to mitigate the damage to people, the technical and organisational measures already in place, previous infringements, the degree of cooperation with the authority, the categories of data affected, and how the authority learned of the breach, in particular whether you notified it. Fines for the most serious infringements can reach EUR 20 million or 4% of worldwide annual turnover under Article 83(5). In practice: notify on time with facts, show the security measures that existed, contain the breach quickly, inform affected people where required and document every step. NetSenX helps with the timeline and with an Article 33 draft for your DPODPO: data protection officer. The person responsible for data protection in a company under the GDPR..
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Can NetSenX prepare a GDPR Article 33 breach notification?
- Does a security tool's audit log help with IT general controls?
- How do we prove who changed a security setting, and when?
- How do we show an auditor which parts of our network are monitored?
- What does network detection miss if a segment is not mirrored?
Terms used here
- GDPR (General Data Protection Regulation)
- The EU data protection law (Regulation (EU) 2016/679).
- DPO (data protection officer)
- The person responsible for data protection in a company under the GDPR.
← All 35 questions on Incident reporting deadlinesAll topics