How To
Responding to data breaches
CCH GDPR Compliance
Breach is probably the most-used word in all of the GDPR. After all, the regulation is about protecting data and eliminating breaches. Many organisations are ill-prepared to respond to these incidents, often due to the culture around admitting and acknowledging them.
You can use CCH GDPR Compliance to log breaches and your organisation’s responses to them. Our breach management workflow helps you do all of the following:
- Understand the possible causes behind incidents.
- Understand what the typical response should be. Assemble and manage the response team.
- Perform an initial assessment.
- Record the likely causes.
- Record the incident location.
- Record any preventative measures that were in place.
- Determine the risks to data subjects and steps they might take to mitigate impact.
- Include law enforcement in any decision making.
- Produce suggested content for engagement with your supervisory authority.
- Produce suggested content for engagement with data subjects.
- Evaluate the effectiveness of your response.
If you need to report a breach to your supervisory authority, then the workflow alerts you and gives you a downloadable report you can use as the basis of the report you submit. If you need to report a breach to impacted data subjects, then the workflow will alert you and give you a downloadable email, which you can use as the basis of the email you send to the impacted individuals.
The breach log gives you a historical record of all the incidents to ensure that the learnings from them have been implemented.
Related documents
CCH GDPR Compliance MFA
The document outlines the implementation of multi-factor authentication (MFA) for users of the CCH GDPR Compliance application to enhance account security. It explains that users must provide two factors for access, specifically a password and a verification code sent via SMS or generated through a time-based one-time password (TOTP) app, such as Google Authenticator or Microsoft Authenticator. Instructions for downloading these apps and setting up SMS verification are provided, along with visual aids for the login process and MFA selection.
Stakeholder training and awareness
The document discusses the importance of staff awareness and compliance in data protection programs within organizations. It highlights the necessity of training employees on relevant policies and providing documentation of their understanding and acceptance. The CCH GDPR Compliance tool is introduced, which allows organizations to distribute policies, track employee receipt and acceptance, and monitor compliance status with visual indicators. It emphasizes the need for a record of training efforts and offers templates for communication, ensuring all employees are informed and compliant.
Simplifying Data Subject Access Requests (DSAR)
This document outlines the rights of individuals regarding their personal data and how organizations can facilitate the exercise of these rights. It emphasizes the importance of allowing easy access to rights through communication channels. The process for handling Data Subject Access Requests (DSAR) is detailed in three steps: receiving and logging requests via a customizable online form, validating requests by confirming the requester's identity, and responding appropriately to the request while ensuring compliance. The document stresses the importance of training staff and maintaining records for accountability and transparency.
Ensuring third parties are compliant
This document emphasizes the importance of managing personal data shared with third parties, particularly concerning GDPR compliance. It highlights the necessity for written agreements outlining data processing practices and the need for meticulous logging of data transfers. The document addresses the complexities of sharing data with both processors and controllers, including specific legal obligations when processors are outside the EU. It underscores the distinct legal responsibilities between controllers and processors and recommends mapping these relationships for clarity and compliance. Additionally, it offers tools for generating agreements and recording legal bases for data sharing.
Do you need a Data Protection Officer?
The document emphasizes the importance of human involvement in achieving GDPR compliance, highlighting that organizations must protect individuals' data through established processes. It introduces CCH GDPR Compliance as a collaborative workflow tool where team administrators can grant access to users, including external Data Protection Officers (DPOs). The document outlines the necessity of appointing a qualified DPO based on regulatory requirements and encourages organizations to assess their need for one. For questions regarding DPO appointments, it directs readers to CCH Software Support for assistance.