Breach Risk Assessment

Scenario 2: Ransomware Without Backup

• Facts: Small manufacturing company hit by ransomware. Employee payroll data permanently lost. No backup exists.
• Classification: Availability breach (permanent).
• Risk assessment: Data sensitivity = 3, Volume = 1 (45 employees), Identifiability = 4, Consequences = 3, Vulnerable = 2, Controller = 2. Total = 15.
• EDPB conclusion: Notify SA and data subjects. Permanent loss of payroll data directly impacts employees' financial interests.

Scenario 3: Data Exfiltration from Website

• Facts: SQL injection attack extracts usernames, hashed passwords, and email addresses of 1.2 million registered users from an e-commerce platform.
• Classification: Confidentiality breach.
• Risk assessment: Data sensitivity = 2, Volume = 4, Identifiability = 3, Consequences = 2, Vulnerable = 1, Controller = 3. Total = 15.
• EDPB conclusion: Notify SA and data subjects. The combination of email addresses with hashed passwords enables credential-stuffing attacks against other services.

Scenario 4: Misdirected Email (Single Recipient)

• Facts: HR department sends a single employee's salary slip to the wrong internal colleague by email. Error discovered within 10 minutes. Recipient confirms deletion.
• Classification: Confidentiality breach.
• Risk assessment: Data sensitivity = 3, Volume = 1, Identifiability = 4, Consequences = 1, Vulnerable = 2, Controller = 1. Total = 12.
• EDPB conclusion: Notify SA (marginal). No DS notification required. The breach is contained, the recipient is known and cooperative, and financial data exposure is limited.

Scenario 5: Lost Unencrypted USB Drive

• Facts: Employee loses an unencrypted USB drive containing names, addresses, and national insurance numbers of 3,500 pension scheme members.
• Classification: Confidentiality breach.
• Risk assessment: Data sensitivity = 3, Volume = 3, Identifiability = 4, Consequences = 3, Vulnerable = 3 (elderly/retirees), Controller = 3. Total = 19.
• EDPB conclusion: Notify SA and data subjects. Government identifiers combined with vulnerable population (retirees) creates high identity theft risk.

Scenario 6: Accidental Publication of Student Grades

• Facts: University accidentally publishes exam results with student names on a publicly accessible web page for 36 hours before removal.
• Classification: Confidentiality breach.
• Risk assessment: Data sensitivity = 2, Volume = 2 (800 students), Identifiability = 4, Consequences = 2, Vulnerable = 2, Controller = 3 (education). Total = 15.
• EDPB conclusion: Notify SA and data subjects. Academic performance data linked to names, public exposure for 36 hours, potential impact on students' academic and professional prospects.

Assessment Documentation Requirements

Every breach risk assessment must be documented with the following elements:

1. Assessment metadata: Date, assessor name, breach reference number, version
2. Breach description: Factual summary of what occurred
3. CIA classification: Which type(s) of breach
4. Factor-by-factor scoring: Each factor scored with written justification
5. Aggregate score and threshold determination: Which notification obligations apply
6. DPO recommendation: DPO's concurrence or dissent with the assessment
7. Management decision: Final notification decision with sign-off
8. Re-assessment trigger: Conditions that would require re-scoring (e.g., exfiltration later confirmed)

Common Assessment Errors

1. Underscoring consequences because exfiltration is "unconfirmed": The absence of evidence of exfiltration is not evidence of absence. Score consequences based on what could happen if the data is in unauthorized hands.
2. Treating encrypted data as automatically low-risk: Encryption is only mitigating if the encryption keys were not also compromised and the encryption standard is robust (AES-256 or equivalent).
3. Aggregating multiple small breaches: Recurrent similar breaches (e.g., repeated misdirected emails) may indicate a systemic issue that elevates the aggregate risk beyond what each individual incident would suggest.
4. Ignoring availability breaches: Temporary loss of access to health records, financial data, or safety-critical information can cause harm even if confidentiality is not compromised.
5. Applying the 250-employee exemption to notification: Art. 30(5) provides a limited RoPA exemption for small organizations, but there is no such exemption for Art. 33/34 breach notification obligations.