Dealing with security breaches

• Definition of a security breach

  A breach of personal data security has occurred when the breach leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or otherwise processed, whether the processing is physical or electronic. Loss of or unauthorized access to information that is not personal data but is of a protectable nature (e.g., patents, confidential agreements, contracts, or other) must – just like breaches of personal data security – be reported if these are lost or become accessible to unauthorized persons.
• Why you should report a security breach

  Breaches must be reported, partly to protect the individuals whose information is involved, partly to prevent possible damage to SDU's business, and not least to learn from the incident.
  
  It is not enough to simply ask the recipient of a misdirected email to delete it, to fail to register the breach because your computer was "only" gone for an hour on the train or that "they have a duty of confidentiality, so it doesn't matter." All incidents must be registered on SDU's internal security incident log.
  
  When you receive emails, you should always make sure that they are sent by a trustworthy recipient (e.g. call the sender or ask a colleague if they have received a similar email if you receive something suspicious). In such a case, you can use the "Report Phishing" button in Outlook. If you have accidentally clicked on a suspicious link and fear that you have lost control of your IT equipment, fill out the security breach report form.

• How your personal data is handled by SDU when you report a breach

  When you report a security incident via the form, the University of Southern Denmark processes information about you - specifically your full name and email address. The data is processed solely for the following purposes:

  • To identify the person who has reported a security breach
  • To be able to acknowledge the report
  • To be able to contact the reporter if further information about the case/incident is required

  The data is therefore processed solely to enable SDU as data controller to comply with the rules on keeping an internal log of security breaches. If you have any questions about the processing of your personal data in this regard, you can contact SDU's Data Protection Officer.