Zansa › Answers › Privacy, security and ownership
What should a small business do first if it suffers a data breach?
Contain it, record what happened, assess what personal data was affected, and check whether you must notify a regulator or affected individuals. Act quickly, because some laws set short deadlines. This is general information, not legal advice. Check how this applies to you with a qualified adviser.
Immediate steps usually include:
- Stop the exposure, for example by resetting passwords or revoking access
- Preserve logs and evidence
- Work out what data and which people are involved
- Inform your operators or processors where relevant
- Decide on notification with legal advice
Under GDPR, notifying the supervisory authority is generally due within 72 hours of becoming aware, where required. POPIA requires notification as soon as reasonably possible. Confirm current rules locally.
Want this applied to your business? Zansa builds dashboards and forecasts for small and mid-sized companies worldwide. Start with a free intro call.
Book a call