Recognising and Reporting Data Breaches

By the end

What you'll build

• Recognise the common breach patterns, including loss of availability and misdirected disclosure
• Take safe immediate containment steps without destroying evidence
• Report an incident internally with the facts responders need, within your organisation's timeframe
• Explain why suspected breaches are escalated before they are confirmed
• Describe how notification decisions are made and who makes them

Curriculum

What's inside

7 modules · 42 lessons

1. 01

   What counts as a breach

   7 lessons
   • Confidentiality, integrity and availability: three ways personal data breaks
   • Misdirected email and the wrong-attachment problem
   • Lost devices, papers and unattended screens
   • Ransomware and lock-out as an availability breach
   • Unauthorised access by someone who works here
   • + 2 more lessons
2. 02

   Spotting it early

   6 lessons
   • The weak signals that precede most reported incidents
   • What people outside the organisation tell you first
   • Unexpected system behaviour and permission surprises
   • Reports from customers, partners and suppliers
   • Why 'probably nothing' is still worth a report
   • + 1 more lesson
3. 03

   First response without making it worse

   6 lessons
   • The first fifteen minutes: contain, preserve, escalate
   • Safe containment steps a non-specialist can take
   • Evidence preservation: what not to delete, wipe or reboot
   • Recall attempts and their limits
   • Do not investigate alone or contact the other party
   • + 1 more lesson
4. 04

   Reporting internally

   6 lessons
   • Writing an internal breach report that responders can act on
   • The facts to capture: what, when, whose data, how many, where now
   • Reporting when you are unsure of the details
   • Channels and out-of-hours routes
   • Why the clock starts at awareness
   • + 1 more lesson
5. 05

   What happens next

   6 lessons
   • From your report to a decision: how assessment and notification work
   • Risk assessment to individuals, not to the organisation
   • Who decides on regulator and individual notification
   • Your part in the follow-up: statements, timelines and cooperation
   • Remediation and lessons learned
   • + 1 more lesson
6. 06

   Breach-resistant habits

   6 lessons
   • Everyday practices that prevent the most commonly reported breaches
   • Recipient checking, blind copy and distribution lists
   • Handling exports, downloads and offline copies
   • Device, paper and clear-desk discipline
   • Leavers, movers and lingering access
   • + 1 more lesson
7. 07

   Practice and check

   5 lessons
   • Signal, type, responsematch pairs
   • The first fifteen minutessequence order
   • Report it in the right wordsfill blank
   • The hidden tabscenario
   • Course quizquiz

The shape of it

How this course works