OPC GUIDANCE ON BREACH REPORTING

The OPC recently published an article on privacy breaches, in which they said they were now taking a “more proactive approach” to remind and warn organisations about their responsibilities.

The OPC criticised the time it was taking some organisations to notify breaches, and said that, unless there were “extenuating circumstances”, a serious privacy breach should be reported within 72 hours of the organisation becoming aware of it.

KEY TAKEAWAYS

There are simple practical steps you can take to minimise your risk of a serious privacy breach and ensure that you report any notifiable breaches promptly:

• Email: Double check the recipient and attachments before sending, to ensure they are correct.  Use the “BCC” function where appropriate.
• Security: Restrict access to personal information to only those people who need to see it.
• Educate: Educate your staff on privacy. This will help prevent breaches occurring, and increase your likelihood of identifying and responding to a privacy breach quickly.
• Response Plan: Have a privacy breach response plan in place – so you are ready to respond if a breach occurs.
• Audit: Audit your privacy practices using our “Privacy Warrant of Fitness”, available here. 

If you have any questions about privacy, or would like our help to comply with the Act, please get in touch.