Sometimes, you have to inform the data subject, even though there's not much they can do.
How do you work with that?
We recently discussed this at our Sustainable Compliance Live, where we meet with practitioners in data protection and information security every other week to discuss and share advice.
Here are the top ten tips that emerged from the discussion:
- Be clear and precise in your communication about the data breach.
- Use understandable language that speaks directly to the recipient.
- Test your communication on a group of citizens to ensure they understand what you write.
- Provide clear information about what has happened.
- Describe the likely consequences of the breach.
- Specify the measures taken to handle the breach.
- Be transparent and honest in your communication.
- Is a notification necessary and desirable? The data subject is likely to feel insecure.
- Make sure to provide a contact person for the data subject to obtain further information. Perhaps it should not be the DPO, but someone closer to the data subject's everyday life.
- Assess the need to inform about identity theft and potential consequences.
