What are the legal consequences of a data breach?

According to the European Commission, a data breach is when ‘the data for which your company/organisation is responsible suffers a security incident resulting in a breach of confidentiality, availability or integrity’.

The causes of this can vary, but ultimately it is the organisation’s responsibility to prevent this situation from arising. Breaches can often result from:

• Cyber-attacks- such as credentials-stuffing (using leaked login information to access other websites)
• Insider threats- such as employees selling company data to competitors
• Malpractice or negligence- such as sending emails that contain sensitive information to the wrong person

Sensitive data at the heart of data breach may include financial information like card details, personal data such as addresses or phone numbers, or medical records.

If a breach is likely to result in:

• Discrimination
• Damage to reputations
• Financial loss
• Loss of confidentiality
• Any other significant economic or social disadvantage

Then the first thing you should do is report it to the Information Commissioners Office (ICO). You must then collate all the facts about what happened together and take adequate measures to contain the breach. You must then assess the overall risk of this breach to those involved and provide support to mitigate this (such as advising people to change their passwords and be aware of any suspicious emails). You should then contact the ICO or use their self-assessment tool to assess if you need to officially report this breach.

To facilitate this process, it’s crucial to cultivate a zero-tolerance mindset towards breaches within your organisation, as well as to create a plan and process for if a data breach ever occurs.

In the UK, organisations subject to GDPR have to report data breaches to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of them. It’s important to be aware that delays in reporting can lead to higher fines and damage to your business’ reputation.

For high-risk breaches, which would put individuals’ immediate safety at risk, the people impacted must be informed immediately.

The legal consequences of a data breach in the UK are extensive and severe.

If an organisation is found to have been non-compliant with GDPR, they face some significant fines. For serious breaches, fines can be up to £17.5 million or 4% of global turnover- whichever is higher.

However, the highest fine given out by the ICO to date was to Meta Platforms Ireland Ltd in 2023; due to violating GDPR’s international transfer guidelines, they were fined €1.2 billion in 2023. Legal repercussions of data breaches tend to be more severe if it is found that an organisation was negligent or non-compliant with legislation.

It’s not just fines from regulators that businesses have to worry about, however. Civil action can be taken by individuals impacted by data breaches to compensate for any damage they have incurred.

 Legal repercussions increase if breaches are due to negligence or intentional non-compliance. Furthermore, repeat offenders or those with systemic security failures may face heightened scrutiny and stricter penalties.

Yes, individuals can be held accountable if found responsible for causing a data breach. Employers can take disciplinary action against employees responsible for breaches, but legal penalties for individuals usually only apply in cases of intentional wrongdoing.

Data breaches caused by the actions of individuals can occur through:

This would involve an individual intentionally causing a data breach. This could be for malicious reasons such as blackmail or by intentionally accessing confidential information out of curiosity.

GDPR does not typically impose legal penalties on individuals- any legal consequences on the individual will depend on national laws. This is because, under GDPR, organisations are primarily held responsible for data protection and therefore can be fined for data breaches.

However, both individuals and organisations must take data protection seriously to prevent data breaches. This means it’s vital that employees are adequately trained in data security and protection measures.

Cyber incidents accounted for 29% of breaches reported to the ICO in Q2 2023- Q2 2024. The most common causes of data breaches during this time were:

• Emailing data to the wrong people
• Phishing
• Unauthorised access
• Data posted or faxed to the wrong people
• Ransomware
• Failure to redact

According to Verizon, 68% of breaches involved human-error or falling victim to a social engineering attack, so inadequate training, processes, and systems can play significant roles in data breaches.