GDPR Compliance: Notification of Data Breaches – Cyber attacks

As a business owner in Cyprus and in light of the recent cyber-attacks to the University of Cyprus and the Land Registry Department, it is important to understand your responsibilities when it comes to data protection and the notification of data breaches or hacking incidents. The General Data Protection Regulation (GDPR) sets out strict obligations and guidelines for companies to follow in the event of a data breach.

In the event of a serious data breach or hacking incident, the first step is to notify the relevant authorities. According to the GDPR you should inform the Office of the Commissioner for Personal Data Protection without undue delay and, where feasible, not later than 72 hours after having become aware of it. You should also report the incident to the Cyprus Police Cybercrime Subdivision the Office for Combating Cybercrime which is responsible amongst others for the investigation of crimes committed via the internet or via computers.

Moreover, if the breach poses high risk to the rights and freedoms of the persons whose data have been exposed, you must also notify the affected individuals personally without undue delay.

When notifying the Commissioner and the affected individuals, it is important to provide specific details about the breach. This includes the nature of the breach, the types of data that were compromised, the number of individuals affected, and the potential consequences of the breach.

It is also important to take steps to mitigate the effects of the breach and prevent further damage. This may involve working with IT security or Legal experts to identify and address any vulnerabilities in your systems or processes or any regulatory compliance obligations.

Finally, it is important to take steps to prevent future data breaches. This may involve implementing new security measures, such as encryption, access controls, and monitoring systems, to help protect against future attacks.

Polina Christodoulou, Associate Partner – Head of GDPR

Vasilis Charalambous, Senior Lawyer - Head of GZGTech

George Z. Georgiou & Associates LLC

Read More

ICPAC looks ahead into 2024
The evolution of banking and the role of EMIs
Per aspera ad astra: Through hardships to the stars
Change Management in Business Transformation: Realising the 3 challenges to succeed
Cyprus' construction sector: Navigating demographic shifts and international demand
Conquering the Clicks: A guide to thriving in the online marketplace
Protection of Vasiliko energy infrastructure
Raising Capital: Trends and Strategies for Private TMT Companies in 2024
How trademarks empower businesses in the Digital Era
Immersive Scrolling: How every click tells a story