Report a cross-border personal data breach | Integritetsskyddsmyndigheten

FromPortal

StartCRH

Please use this form to notify a personal data breach to IMY. If you are not able to answer all the questions at this stage, you may provide supplementary information later on but it is important that we receive the information without undue delay. Fields marked with an asterisk (*) must be filled in before submitting the application.

When you have filled in the form, press "send". We will confirm that we have received your notification and you will then be able to download a copy of it.

Controller

1. Name of the organisation

Please enter the name of the controller where the data breach occurred.

2. Corporate identity number

Please enter the corporate identity number (XXXXXX-XXXX). Note! If the corportate identity number is the same as your personal identity number, you should not enter it.

3. Postal address of the controller

Please enter the postal address, not visiting address.

Address

Postcode

City

Country

4. Internal reference number

Please enter the organisation's internal reference number for the data breach.

9. The postal address you wish to be contacted at

Letters that IMY will send to you regarding the notification will be sent to this address.

Address

Postcode

City

Country

The data breach

10. Which other countries are concerned by the data breach?

11. When did the data breach occur?

Date

Time

If you have a comment, please write it here

characters left

12. When did you become aware of the data breach?

Date

Time

If you have a comment, please write it here

characters left

13. Is the data breach still ongoing?

14. When did the data breach cease?

Date

Time

If you have a comment, please write it here

characters left

15. If your notification is submitted later than 72 hours after the time of discovering the data breach, please describe the reasons why.

16. What has happened in relation to the data breach?

Please select the most relevant option.

17. Short description of the data breach

18. What kind of data breach does the notification relate to?

Please state a comment when selecting "Other"

characters left

19. How did you become aware of the data breach?

20. In your organisation's opinion, why did the data breach occur?

Please state a comment when selecting "Other"

characters left

21. Within which sector did the data breach occur?

22. Within which field of activity did the data breach occur?

Please state a comment when selecting "Other"

characters left

Processor

23. Does the data breach relate to personal data processing that is carried out by a processor or sub-processors?

The personal data and the data subjects

25. How many data subjects are affected?

Exact number of data subjects

If you do not have an exact number, please provide an estimate by marking one of the options below.

26. How many data items about data subjects have been affected in total?

Exact number of data items

If you do not have an exact number, please provide an estimate by marking one of the options below.

27. Which categories of data subjects are concerned?

Please state a comment when selecting "Other"

characters left

28. What categories of personal data have been affected by the data breach?

Please state a comment when selecting "Other"

characters left

29. Was the personal data encrypted?

Consequences

30. What may be the consequences of the data breach?

Please state a comment when selecting "Other"

characters left

31. What other consequences may be the result of the data breach?

Confidentiality breaches

A larger distribution of personal data than necessary or consented by the data subjects

Personal data may be linked with other information about the data subjects

Other:

Please state a comment when selecting "Other"

characters left

Integrity (alternation) breaches

Incorrect personal data may have been processed by mistake

Personal data may have been processed for other purposes than originally intended

Other:

Please state a comment when selecting "Other"

characters left

Availability breaches

Loss of the ability to provide a critical service to the data subjects

Alteration of the ability to provide a critical service to the data subjects

Other:

Please state a comment when selecting "Other"

characters left

32. How serious is this data breach in your opinion?

Assess how serious the breach is with regard to the data subjects’ privacy.

33. How have you acted after the data breach?

Describe the action taken. Have you taken measures, or do you intend to take measures in order to solve problems, prevent or mitigate the effects of the data breach?

Information to data subjects

34. Have you informed the data subjects about the data breach?

35. When did you inform the data subjects?

Date

36. How have you provided information to the data subjects?

37. Will you inform the data subjects later?

38. When will you inform the data subjects?

Date

39. On what grounds are you not going to inform the data subjects?

The data breach does not result in a high risk to the rights and freedoms of natural persons

The personal data was encrypted or otherwise protected

We have already taken measures to prevent the risk

It would involve a disproportionate effort to inform each data subject individually, we have instead provided information to the public

40. If relevant: Describe the measures taken in order to prevent the risks so that information to the data subjects is not required.

41. If relevant: Describe in what way you have informed the public or what other measures you have taken in order to inform the data subjects in an efficient way.

Notification in phases/secrecy

42. Will this notification be supplemented? If you are going to complete the notification later you must do so promptly.

43. If you think that certain information in the notification should be considered confidential, please describe which information that in your view should be confidential and why.