GDPR Compliance: Notification of Data Breaches – Cyber attacks

As a business owner in Cyprus and in light of the recent cyber-attacks to the University of Cyprus and the Land Registry Department, it is important to understand your responsibilities when it comes to data protection and the notification of data breaches or hacking incidents. The General Data Protection Regulation (GDPR) sets out strict obligations and guidelines for companies to follow in the event of a data breach.

In the event of a serious data breach or hacking incident, the first step is to notify the relevant authorities. According to the GDPR you should inform the Office of the Commissioner for Personal Data Protection without undue delay and, where feasible, not later than 72 hours after having become aware of it. You should also report the incident to the Cyprus Police Cybercrime Subdivision the Office for Combating Cybercrime which is responsible amongst others for the investigation of crimes committed via the internet or via computers.

Moreover, if the breach poses high risk to the rights and freedoms of the persons whose data have been exposed, you must also notify the affected individuals personally without undue delay.

When notifying the Commissioner and the affected individuals, it is important to provide specific details about the breach. This includes the nature of the breach, the types of data that were compromised, the number of individuals affected, and the potential consequences of the breach.

It is also important to take steps to mitigate the effects of the breach and prevent further damage. This may involve working with IT security or Legal experts to identify and address any vulnerabilities in your systems or processes or any regulatory compliance obligations.

Finally, it is important to take steps to prevent future data breaches. This may involve implementing new security measures, such as encryption, access controls, and monitoring systems, to help protect against future attacks.

Polina Christodoulou, Associate Partner – Head of GDPR

Vasilis Charalambous, Senior Lawyer - Head of GZGTech

George Z. Georgiou & Associates LLC

Read More

Real Estate Tokenisation: The Future of Investment in Property
Top 10 Trends Shaping the PR Landscape in 2023
Exploring Housing Provision in Cyprus: The Government's Options
VAT on financial services and FinTech: The story of the CFO and the need for reform
Cyprus’ hospitality and tourism sector performance in 2022
Corporate Sustainability Due Diligence Directive: Moving away from random ESG practices
The outlook for private markets is bright
BOC strategist: 2023 should be a good year for bonds
Sourcing of ESG data: a challenge or an opportunity?
Machine Learning (ML): An enabler in a changing AML/CFT landscape