Data Protection

What is the Data Protection Breaches Process?

Protecting personal data is a critical consideration for all of us at University of Galway.  

We are required under national and European law to take appropriate measures against unauthorised or unlawful processing and against accidental loss, destruction of or damage to personal data.

Any breach of the Data Protection Acts 1988 - 2018 and the European General Data Protection Regulation 2016 may render the University liable to action by the Data Protection Commissioner and by the person affected by the breach. 

All University of Galway users of personal data have a responsibility to ensure that they process such data in accordance with the Data Protection Acts 1988 - 2018 and in accordance with the General Data Protection Regulation 2016.

The University’s Data Protection Officer has a key role in this. All data breaches, whether accidental or not, should be reported to the Data Protection Officer so that appropriate advice can be given, and appropriate action can be taken, where possible to contain the breach or to advise any individuals likely to suffer distress or inconvenience as a result. Throughout the breach management process records should be kept of what action has been taken and by whom.

In the case of a personal data breach, University of Galway is obliged to notify the personal data breach to the Office of the Data Protection Commissioner within 72 hours, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.

A data security breach can happen for several reasons:  

• Loss or theft of data or equipment on which data is stored 

• Inappropriate access controls allowing unauthorised use 

• Equipment failure 

• Human error 

• Unforeseen circumstances such as a fire or flood 

• Hacking 

• ‘Misrepresentation’ offences where information is obtained by deceiving the organisation who holds it. 

Where a personal data breach has occurred, there are four important elements to any breach management plan: 

1. Containment and recovery 

2. Notification of Breach

3. Assessment of ongoing risk 

4. Evaluation and response

If you believe a data breach has occurred, or are unsure whether a data breach has occurred, the best course of action is to contact the University Data Protection Officer for advice.

Training on data protection matters is made available to staff by the Data Protection Officer.

Further Information