Data has been stolen or leaked from my organisation

Based on the notifications, the authorities receive important information on how common data breaches and data leaks are. The authorities also communicate about new data security threats, thus enabling other organisations to avoid data breaches.

The procedures for submitting a notification of data security violations vary in different countries. Find out what kind of obligations to notify data breaches or data leaks there are in the countries in your organisation’s operating area.

A personal data breach is an event as a result of which personal data is destroyed, lost, altered, disclosed without authorisation or a party without the right to process the data gains access to it.

Personal data breaches include incidents such as

• a lost data transfer device, e.g., a USB memory stick
• a stolen computer
• data breach
• malware infection
• sending an email containing personal data to a wrong person. 

Consider the following matters when assessing the risk:

• type of data security infringement
• nature, sensitivity and amount of the personal data
• ease of identification: how easily can persons be identified from the material
• characteristics of the persons subject to the violation: is the violation targeted at children, for example
• sector and role of your organisation 
• severity of the consequences of the data leak.

Read more about assessing the risk of data security violations on the website of the Office of the Data Protection Ombudsman.Opens in a new window.

If the data security violation may cause a risk to the persons subject to the violation, a notification is required. Data breaches typically cause risks to persons subject to the violation. 

Persons subject to a data security breach must be informed if the data security breach is likely to cause a high risk to the rights and freedoms of these persons. Familiarise yourself with more detailed instructions on the notification obligation on the website of the Office of the Data Protection Ombudsman. Opens in a new window. On the website, you will also find instructions for what the organisation must tell the persons subject to the violation.

Reporting an offence is the right of the organisation subject to the data breach. In addition, the report may lead to the tracks of offenders that have committed several times However, Finnish legislation does not oblige to notify to the police offences that have already taken place: the organisation can consider itself whether it wishes to notify the police about a data breach targeted at trade secrets.  

Read more about why cyber crimes should always be reported from the publication “Cyber crime is a police matter – a guide to the cyber crime investigation process (Police University College and Jyväskylä University of Applied Sciences) (in Finnish). 2021).Opens in a new window.

When you submit a notification, you also help other organisations that may become subject to a possible data security violation.

On the basis of the notifications, the National Cyber Security Centre 

• investigates data security violations and their threats targeted at web services, messaging services and value added services
• collects information on these events 
• communicates information on data security.