1. INCIDENT RESPONSE PLAN
DATA BREACH
INCIDENT RESPONSE PLAN
Privacy by Design/International Schools
March 7-8, 2019

2. Normal day at the school
Your school has online apps to process students’ data and severeal other tools to communicate with parents and other schools
One Friday evening, there is a report in the news stating that your hosting provider is a target of massive hack
Estimates are that millions of citizens’ data is at risk
At the end of report there are logos of organisations that are at risk, and your school’s logo is blinking among them
You are DPO and you phone seems to be almost going off due to mails, sms and other messages

3. In a perfect world…. … your school would have:
Clear incident response plan with roles & responsibilities
Confirmed communication channels with one dedicated contact point
A media-trained director(s) to give statements
Dedicated 24/7/365 contacts to all your third parties
A back-to-back responsibility chain in all 3rd party agreements
Operations continuation plan

4. If you have none of those
Get hold of IT, Legal, Communications and management level asap
Check yourself or get Legal reviewing your agreement with target company
Contact the target company to establish communication channel
Contact other schools’ representatives
Agree on giving statements and on one single contact point
Agree on giving information at your website (if not compromised) or any other means to your datasubjects
Agree on steps to define width and depth of breach notification for authorities
Instruct your call center and reception staff

5. Your first priority = students and teachers
Under GDPR and several other regional laws you must ensure the security of the data of end-users
The type of data and their quantity are important, yes but
other considerations include:
Possibly a criminal investigation
an e-discovery process
Employee and school-board considerations
If police is involved, they want to keep things quiet, but the press not
Try to limit damages while complying with legal requirements

6. Co-ordination and co-operation are the key
It is important to have a consistent approach
Coordinate with other schools
Is it possible to agree on common statement –or let the target speak?
Follow-up to be agreed
Post mortem to be agreed – lessons learned
Ensure that mistakes are not repeated, but corrected