[Chris Argent]

Here the official guidelines- https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/

[Tanbir Jasimuddin]

Address GDPR first – not only is there a hefty fine at risk, but you will still suffer the cost of bad PR

[Unknown Member]

You need to work on both straight away but more importantly you need to prepare for a breach now and kick the plan into action immediately following the breach. Yes GDPR has massive potential financial penalties for non compliance but, depending on your business, poor customer communication can damage your business, potentially terminally.

I’m currently working as an adviser with Kroll, a leading Cybersecurity provider, who support companies in their response in more than 3,000 breaches a year. They have a good basic introduction to developing your response plan @ https://www.kroll.com/en/services/cyber-risk/governance-advisory/incident-response-plan-development

[Val Elliott]

Agree. Part of the obligations is to inform those affected and the right tone will pay back.

Dealing with a potential issue with a voluntary group at the moment and interesting that public perception of GDPR is not quite aligned with reality and it is that perception that needs to be handled carefully.