Table of Contents
Data Breach: Experiencing a data breach is one of the most inconvenient and dangerous situations for any company's credibility. This type of situation leaves the company's system and users vulnerable to various scams. However, it happens more often than we imagine, making it necessary for every company to know what to do in this case.
There is a whole protocol that must be followed by the company victimized by this type of intrusion into its systems. And if this protocol is not followed correctly, it may result in severe sanctions for non-compliance. General Law of Data Protection.
Many companies make a mess of things when dealing with such a situation, often trying to cover up the incident in an attempt to make it go unnoticed..
But scandals like Amazon's show that the laws regulating privacy and personal data protection are definitely not to be taken lightly.
Where do companies typically go wrong in these types of situations?
It is important for companies to know how to proceed, as well as what not to do, in order to minimize losses.
To help with this, let's list the biggest mistakes companies make when their systems are hacked and their personal data is exposed.
- Failing to provide adequate training to employees in a way that fosters greater synchronization between the team and its leaders, thus preventing actions aimed at concealing the incident;
- They are not changing the passwords, which would be the appropriate action to contain the leak;
- They fail to adequately measure the impact of the incident: in cases of data breaches, the correct course of action is for the company to paralyze the affected systems, without, however, shutting them down – at the risk of losing records of what happened – understand where and when the incident occurred, and, most importantly, understand what data was compromised.
- They are not informing all departments within the company, nor the affected users, for fear that this will result in greater problems;
- They avoid making public announcements until they are discovered.
The correct procedure in cases of data breaches involves reporting the incident to the company's DPO, to ANPD and holders of personal data involved.
Furthermore, this notification should preferably be made within two business days of the incident being discovered.
It is important to emphasize that the ANPD (National Data Protection Authority) provides details on its website about the information that must be submitted, such as the contact information of the company responsible for data processing and the DPO (Data Protection Officer), in addition to requiring information in the online form such as the date and time of the incident, the circumstances of the incident, a description of the personal data such as its nature, category and how many data points were leaked, all possible consequences and, most importantly, the measures that will be taken to resolve the issue.
The LGPD (Brazilian General Data Protection Law) imposes sanctions for irregularities ranging from warnings and fines of up to 2% of the company's revenue, limited to a total of R$ 50 million per infraction, to publicizing the infraction, blocking the personal data related to the infraction until it is rectified, deleting the personal data related to the infraction, or even partially suspending the operation of the database related to the infraction.
In a scenario where data breaches are increasingly common, it is crucial that companies adopt a proactive and strategic approach to dealing with such incidents. Following the correct protocol, communicating quickly with the parties involved, and taking appropriate containment measures are fundamental actions to mitigate damage and comply with the requirements of the General Data Protection Law (LGPD).
Ignoring or attempting to conceal the problem only increases the risks, further damaging the company's image and subjecting it to severe sanctions. Therefore, transparency, adequate team training, and constant system monitoring are essential steps to prevent and, if necessary, deal with data breaches efficiently. Compliance with the LGPD (Brazilian General Data Protection Law) is not only a legal obligation but also a way to protect customer trust and the company's reputation in the market.
