GDPR data breach increasing or just more reporting?

Are we seeing an increase in GDPR data breach instances since the new rules came into force in May 2018, or is it just a case of more reporting?

According to recent research, reports of GDPR data breach incidents more than doubled between May, which saw the new rules come into force on 25^th, and June 2018 the following month. Does this mean that incidents massively spiked and increased during that short period of time, or are organisations so in fear of the new rules that they’re reporting every little breach that may be happening?

The results are what we expected.

New GDPR data breach rules enforce reporting

Because the new GDPR data breach rules place a far higher emphasis on organisations reporting themselves to the UK’s Information Commissioner’s Office (ICO) right away, or face potentially huge fines, you can see how many people may have “panic-reported” anything that may be considered a breach.

With the monetary fines now in the millions, who wants to risk falling foul of the new rules?

Although we already know that data breach incidents are rapidly growing in the UK and indeed across Europe – and the world – a spike of more than double in such a short period of time is a huge amount.

What the ICO has said about the spike in GDPR data breach reporting

It’s not exactly easy to tell right away, but the ICO has reportedly commented on the fact that there has been a huge instance of over-reporting, and that’s likely a result of the new rules. At the end of the day, organisations don’t want to fall foul of GDPR data breach reporting rules, so it’s understandable to see a spike of this nature within weeks of a major rule change where punishments could cripple a business.

This is what we anticipated.

Not all breach are reportable, and there may still be a great deal of confusion over what is reportable and what isn’t. However, the new rules do mean more accountability and a greater need for reporting, and it could be the case that the spike actually reflects what has been going on all along, and it’s merely been a case of under-reporting before the rule change. If that’s the case, we should be very worried, as it means data breaches are even more rife than originally thought…

We will continue to monitor the trends as time goes on.