/filters:quality(90)/0x275:1920x575/prod01/tudublin-cdn-pxl/media/website/images/header/Student-walking-Blanchardstown-Campus-Header.jpg)
Personal Data Breaches
What should I do if I discover or suspect a personal data breach?
If you become aware of a personal data breach:
- Report it immediately to the Information Governance Office at dataprotection@tudublin.ie
- Complete the Personal Data Breach Report Form
- Inform your line manager or Head of School/Professional Service area, where appropriate
If you are unsure whether an incident is a personal data breach, report it anyway. Do not delay reporting because you do not have all the information.
What is a personal data breach?
A personal data breach is a breach of security that results in the accidental or unlawful loss, destruction, alteration, unauthorised disclosure of, or access to personal data.
Examples include:
- sending personal data to the wrong recipient
- loss or theft of a laptop, mobile phone, USB device or paper records
- unauthorised access to staff, student or other University records
- ransomware, phishing or another cyber incident affecting personal data
- accidentally publishing or sharing personal data
- personal data being altered, destroyed or made unavailable
What is personal data?
Personal data is any information relating to an identified or identifiable living individual.
Examples include:
- name, email address, home address or telephone number
- information contained in a student record or employee HR file
- attendance information or assignment/examination results
- records relating to an individual's behaviour or discipline
What happens after I report a breach?
The Information Governance Office will assess the incident and determine what action is required, including whether the breach needs to be notified to the Data Protection Commission (DPC) and/or communicated to affected individuals.
Not every personal data breach needs to be reported to the DPC. A breach must be notified to the DPC unless it is unlikely to result in a risk to the rights and freedoms of individuals. Where notification is required, it must be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
Where a breach is likely to result in a high risk to affected individuals, those individuals must also generally be informed without undue delay.
Important: Do not contact the DPC or affected individuals about a TU Dublin personal data breach without first discussing it with the Information Governance Office.
Further information
For further information, please see TU Dublin's Procedure for Management of a Data Breach.docx