Technology & Privacy
What should a business do after a data breach?
An employee’s laptop with a spreadsheet of customer contact details was stolen. It was password protected but not encrypted. What steps should we take?
Asked anonymously · 2 weeks ago · Ontario, Canada
·
188 views · 1 answers
1 lawyer answer
Act quickly and document everything. Common steps include:
- Containing the incident, for example by remotely wiping the device and changing passwords.
- Assessing what data was involved, how many people are affected, and the risk of harm.
- Checking notification duties: many laws require notifying a regulator and/or affected individuals within set timeframes when there is a real risk of harm.
- Keeping a record of the breach and your decisions, even if notification is not required.
Also check your insurance policy, which may cover breach response costs if you notify promptly.
This is general information, not legal advice — speak to a licensed lawyer about your situation.
👍 36 helpful
Contact Yara →
Are you a lawyer?
Answer this question to help the asker — and get found by clients with similar issues.
Sign in to answer