The UK Information Commissioner’s Office (ICO) has reprimanded the ACRO Criminal Records Office for security failings that contributed to the organisation being breached three times between July 2021 and June 2023.

As a recent SANS NewsBites commentary noted:

“Outsourcing a security function does not mean outsourcing responsibility for it.”

That’s a point worth emphasising.

Given the sensitivity of the data involved, and the fact that there were three separate breaches (although one appears to have been significantly more serious than the others), it’s perhaps surprising that ACRO was reprimanded rather than fined. Financial penalties for data protection failures can be substantial.

Regardless of the outcome in this case, it’s an important reminder that responsibility for data cannot be delegated away.

If your organisation is the Data Controller, you remain ultimately accountable for the personal data you hold. Even if a third-party supplier suffers a breach, you’ll still be responsible for assessing the impact, managing the response, and determining whether notifications need to be made to affected individuals, the ICO, the Charity Commission, or other relevant bodies.

Working with trusted suppliers is important, but it doesn’t remove your obligations.

This is why supplier due diligence, contractual responsibilities, and incident response planning are so important. Understanding who is responsible for what before an incident occurs can save valuable time and reduce stress when responding to a real-world security event.

What can you do?

If a data breach occurred tomorrow, would you know exactly what your organisation needs to do?

Here are a few questions worth considering:

1. Make sure you understand your reporting obligations. For example, notifiable data breaches must generally be reported to the ICO within 72 hours. Are there other regulators, funders, partners, or contractual obligations that may also require notification?
2. Review your cyber insurance arrangements. If your organisation experienced a security incident, what support would your insurer provide? If you don’t currently have cyber insurance, is it something your Trustees should consider?
3. Create or review your incident response plan. Security incidents are stressful, fast-moving situations. Trying to work out roles, responsibilities, and reporting requirements in the middle of an incident can make things much harder. Even a simple, documented plan can make a significant difference.
4. Review your key suppliers. Do you understand how they manage security incidents, and what support they would provide if their systems were affected? Make sure responsibilities and communication processes are clearly documented.

Ultimately, accountability for personal data sits with the organisation that controls it. While good suppliers can help reduce risk, they can’t take away your responsibility to protect data and respond appropriately when things go wrong.

Photo by Towfiqu barbhuiya on Unsplash