Assessing the risk to individuals

Once a breach is reported and contained, the response owner has to answer one central question: how likely is this breach to harm the people whose data is involved, and how badly? UK GDPR's notification duties are risk-based. They hinge on the risk to individuals, not on how embarrassing or costly the incident is for the organisation.

What harm looks like

Harm to individuals is broader than money. The assessment considers whether the breach could realistically lead to:

• Financial loss or fraud, for example from exposed bank or card details
• Identity theft, from documents like passports or full identity profiles
• Physical harm or danger, for example if an address is exposed for someone at risk from an abusive ex-partner
• Discrimination, damage to reputation, or social harm, particularly from special category data such as health information
• Distress and loss of confidentiality, even without any concrete follow-on damage

What shapes the likelihood and severity

A sensible assessment weighs factors such as:

• What kind of data it is. A newsletter email list is not the same as medical records or safeguarding files.
• How much data and how many people are affected.
• Who the individuals are. Children and vulnerable people raise the stakes.
• Who has the data now. A trusted business partner who confirms deletion is very different from an unknown attacker or the open internet.
• How protected the data was. Strong encryption with keys kept safe may mean the data is unintelligible to whoever holds it.
• How easily individuals can be identified from what leaked.

Three outcomes

The assessment lands in one of three broad places, and each drives a different duty covered in the next lessons:

• Unlikely to result in a risk to individuals: record it internally, no ICO notification required.
• A risk to individuals: notify the ICO.
• A high risk to individuals: notify the ICO and tell the affected individuals themselves.

This is why your factual first-hour note matters so much. The quality of the risk assessment depends entirely on the quality of the facts feeding it.