March 27, 2024   Sven Venzke-Caprarese
Data breaches | GDPR

Data Breaches - Why Training is Vital

Ideally, data breaches wouldn't occur at all - but unfortunately, reality paints a different picture. Sensitising employees helps to avoid getting into situations where detailed attention to the issue becomes necessary. However, if a data breach does occur, the correct response from all parties involved is crucial. Sensitisation and training measures for employees are important here, as there are short deadlines from the moment the breach is detected. In such moments, a lot can go wrong, and panic can ensue if organisations haven't already addressed the issue and prepared accordingly.

What exactly is a data breach?

In the context of data protection law, a data breach always involves a security violation. Additionally, personal data must be affected. Most often, this involves a breach of confidentiality. Sometimes, it's also sufficient if the integrity or availability of personal data is compromised. We'll list some classic examples of data breaches below, but (unfortunately), the imagination knows no bounds here.

Examples of data breaches include:

  • The HR department sends an email to all applicants in "CC" instead of "BCC."
  • Your own online portal gets hacked.
  • A social engineering attack succeeds.
  • An employee discovers they've likely fallen victim to a ransomware attack.
  • Misconfiguration of permissions allows employees to access confidential folders in the HR department.
  • Payroll information is sent incorrectly.
  • Sensitive data is accidentally published on social media.

What to do in the event of a data breach?

Awareness of a data breach triggers a strict deadline. This usually begins when the first person in the organisation discovers the data protection violation or when it is reported by someone outside the organisation. Within a 72-hour period, it must be determined whether the data breach needs to be reported to the relevant supervisory authority and whether notification of the affected individuals is required. It's important that all employees are informed about what constitutes a data breach and how to respond in such a case. This requires a binding policy that regulates the correct handling of a data breach towards all employees: Upon discovery or notification of the data protection violation, it must be immediately reported to the internally responsible person - usually directly to the organisation's data protection officer or possibly to a data protection coordinator. A policy is a good foundation, but it's also important to regularly remind employees of the correct procedures and deadlines for dealing with a data breach. This is where training and awareness measures come into play.

Training on managing data breaches in practice

In principle, every company or organisation should have a training strategy for mandatory data protection training. Initially, this involves imparting the basics of data protection that all employees should know. Such a course naturally also covers how to handle a data protection violation. However, a specific course on data breaches, which succinctly outlines what to do in such a case, can be helpful. Such a course can be offered to employees regularly - e.g., once a year - as a refresher on how to handle a data breach. With such recurring training, you sensitise your employees and ensure that legal deadlines are met.

In addition to basic data protection training, there are other training topics that help prevent data breaches. Data breaches can occur not only due to employee errors or technical problems but also through targeted external attacks. Therefore, ideally, data security is also part of the training strategy to prevent data breaches. In addition to knowledge about information security, this includes sensitising employees to protect against ransomware, phishing, and social engineering.

Try out DSN train's eLearning courses!

Now that you know which training contents are important for dealing with and preventing data breaches, it's crucial to consider "how" to implement them. As a training method, eLearning courses have the advantage of being able to train a large number of employees without needing to book venues or coordinate schedules.

In our interactive eLearnings, knowledge is imparted through exciting stories from everyday work life and directly applied - through answering multiple-choice questions and assignment tasks.

Our training contents are designed by our own team, drawing on the experience of over 150 practitioners who advise our clients daily in the fields of data protection, information security, and compliance.

We recommend the following eLearning courses for your training strategy:

Useful training supplements include:

And if you want to ensure and demonstrate that all employees have undergone the necessary sensitisation, you can rely on our smart Learning Management System (LMS).

We're happy to plan further measures with you to prevent data breaches and, for example, conduct penetration tests of your networks and web applications or jointly plan an anti-phishing campaign.

Can we support you? Feel free to contact us!