Reporting a Data Security Incident

A data security incident can happen to any organization: an email sent to the wrong recipient, a lost laptop, a compromised account, or a system exposed to an outside party. The question that occupies business owners and managers at the critical moment is simple: must we report? To whom? And at what stage? This article explains the general principles under Israeli law and how to prepare in advance.

It should be emphasized that the information is general and does not replace a review of the specific case. The exact requirements depend on the type of database, its security level and the circumstances of the incident, so check them against the current guidance of the Privacy Protection Authority.

What is a data security incident

A data security incident is a situation in which personal information held by the organization is exposed, stolen, altered, lost or used unlawfully, or where there is a reasonable concern that this happened. Common examples:

• A breach of the organization's system or email account.
• Malicious encryption of systems and a ransom demand.
• Loss or theft of a computer, phone or portable drive containing personal information.
• Sending personal information to the wrong recipient.
• An employee accessing or copying information they are not authorized to see.
• Accidental exposure of documents online because of a wrong setting.

Not every incident is a "severe incident". The distinction between an ordinary and a severe incident affects the duty to report, so every incident should be documented and assessed in an orderly way.

A severe incident and the duty to report

The Privacy Protection Regulations (Data Security) require a database owner to keep a record of security incidents and, for databases at a medium or high security level, to report a severe security incident to the Privacy Protection Authority after becoming aware of it. The regulations treat as severe an incident in which information from the database was used, or its integrity harmed, on a significant scale or in a sensitive database. The Authority may also direct that people whose information was affected be notified.

The practical points:

• Reporting is done promptly. Do not wait for a full investigation to finish before acting.
• The Authority may request details, give guidance and require corrective steps.
• Even an incident that is not severe should be recorded internally, assessed and handled.
• Amendment 13 to the Privacy Protection Law tightened the management and oversight duties relating to databases, so verify the current requirements from official sources. More in Amendment 13: What Changed.

What to do when an incident is discovered

A recommended order of action, in general terms:

1. Stop the damage. Disconnect a compromised system from the network, change passwords, revoke access of a suspect account.
2. Preserve evidence. Do not delete logs or reset systems before documenting what happened.
3. Form an initial picture. What information, how many people, which systems, when it began and when it was discovered.
4. Inform internal parties. The privacy protection officer, the information security officer, management and legal counsel.
5. Assess whether it is a severe incident and decide on reporting to the Authority, as the law requires and with legal guidance.
6. Consider notifying those affected. Where there is a real risk to the people whose information was exposed, consider sharing with them what happened and what they can do to protect themselves.
7. Fix and learn. Close the gap, update procedures and train employees.

The role of the privacy protection officer

The privacy protection officer (DPO) is the natural owner of the process: assessing the severity of the incident, helping decide on reporting, coordinating between departments and ensuring the incident is documented and lessons are applied. In many cases the DPO is also the point of contact with the Authority. The role may be filled by an internal employee or an external party. More in The Role of a Privacy Protection Officer and An External Privacy Protection Officer. Who must appoint an officer is explained in Who Must Appoint a DPO.

Documentation: what to record

Good documentation protects the organization and is the basis for learning. For every incident it is worth recording:

• The date of the incident, the date on which the incident was discovered and who discovered it.
• A short description of what happened and which systems were affected.
• The type of information involved and how many people were affected, as far as known.
• The steps taken and who took them, with dates.
• The decision whether to report to the Authority and to those affected, and the reasons.
• The lessons learned and the changes made to procedures as a result.

Preparing in advance: an incident response procedure

An organization that prepares responds faster and suffers less harm. It is worth having:

• A written procedure that defines who decides, who reports and in what order to act.
• An up-to-date contact list: the officer, IT provider, legal counsel, and the insurer if there is a cyber policy.
• Data mapping. It is difficult to assess an incident if you are not aware of what information is held and where.
• Employee training. Many incidents begin with human error or a phishing message.
• Practice. A tabletop run-through of at least one scenario a year.
• Supplier agreements. A supplier that processes information on your behalf should undertake to notify you quickly of an incident.

Common mistakes

• Waiting and checking "a little more" before informing the relevant parties.
• Deleting evidence and log files while trying to clean up the system.
• Assuming an incident at an external supplier is not the organization's responsibility.
• Not recording minor incidents, and so missing a recurring pattern.
• Having no written procedure, so that at the critical moment nobody knows who decides.

In summary

A data security incident is not a reason to panic, but it demands an orderly response, documentation and a legal assessment of the duty to report. An organization with a clear procedure and an officer who knows the process is in a better position in any incident. If you want to prepare an incident response procedure or check what applies to your organization, you are welcome to contact us. More about the field on the Privacy Protection and DPO page.

The information in this article is general, is not legal advice, and does not replace a review of the specific case.