The template could be of particular interest to SMEs and supervisory authorities. The former could rely on it instead of undertaking a descriptive exercise in the midst of a data breach, for which they may not have the resources. The latter could benefit from a standardised format allowing them to share incident data across borders, to better detect trends and to gain insights about how to combat cyberthreats across Europe.
The template is set up in such a way that the information gathered can be shared without the need to be anonymised or aggregated, as it will not be possible to identify a company through the information it provides.
If used widely, the template could contribute to enhancing the information and data that is available on cyber risks, and so increase society’s cyber resilience. Currently, the lack of available information on cyber events hampers a range of stakeholders, notably insurers, which are limited in their ability to offer cyber risk cover and related services. This could change if insurers are granted access to the anonymised data that will be gathered by the national supervisory authorities as a result of the data breach provisions.
How it works
The template has three distinct sections:
• Personal details and information on the affected company (not to be shared with third parties).
• Details on the data breach incident as per the indications in Article 33 of the GDPR, to be sent to the national supervisory authority, where feasible, no later than 72 hours after having become aware of the breach.
• A section to be completed following the 72 hour period when more information is available on the data breach, which includes complementary data sets to gain more in-depth knowledge of the nature of the breach.
Download the Template
|
