All tabletop exercises
Data breach·Starter·Mixed audience
A spreadsheet of staff data sent to the wrong person
The prompt — read this to the room
An HR coordinator meant to email a salary review spreadsheet to the payroll provider. Autocomplete picked a similar name at a recruitment agency instead. The file holds names, salaries, home addresses and sickness absence notes for 340 employees. An hour later the recipient replied: 'I think this was meant for someone else.' The coordinator is panicking and has asked a friend in IT to 'just recall it'. It is now 16:30 on a Thursday. What happens next, and who needs to know?
Total duration
1 h
People to involve
5
Best fit
Any sector
Who to involve
Most important first.
- Privacy officer / DPO
- HR
- Legal counsel
- CISO / Head of security
- IT operations
What it tests
- Run a breach risk assessment on an accidental disclosure that includes health data.
- Decide whether the GDPR Art. 33 72-hour notification applies, and record the reasoning either way.
- Get a credible deletion confirmation from the recipient, including any onward copies.
- Fix the process, not just the person, and treat the employee fairly.
Outline of activities
- 1Containing the disclosure
- 2Assessing the risk to the 340 people
- 3To notify or not, and writing it down
- 4Telling staff and fixing the process
- 5Hot wash
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…