Who Needs to Be Told? Notifying Data Subjects After a Breach
Should you notify individuals after a breach? UK GDPR requires it if their risk is high. Here’s how to assess that.
If a data breach is likely to result in a high risk to the rights and freedoms of individuals, you must inform them without undue delay.
High-risk examples:
- Loss of financial or ID data
- Health records exposed
- Location or children’s data compromised
Your message should:
- Use plain language
- Explain what happened and when
- List recommended protective steps
- Provide contact information
Clear and timely communication helps mitigate harm and maintain trust.
