Drone exam · Privacy and data protection

A memory card containing identifiable survey footage is lost on public transport. No one knows whether anybody opened it. Should the event be treated only as lost equipment?

Answer

No. It may also be a personal data breach because confidentiality has potentially been lost. Follow the organisation's breach assessment and notification process under the applicable law.

Explanation

A breach can exist without proof that someone misused the data. The first questions are what was lost, how well it was protected, who may be affected, and what action is required.