The next question: what could that login reach?

Under UK GDPR you have 72 hours from becoming aware of a breach to tell the ICO, unless it’s unlikely to put people at risk. Before you can make that call, you need to know which systems the compromised account could reach, which processing activities use those systems, whose data was there, and how sensitive it was.

Your access controls tell you what an account could log into. Your Record of Processing Activities should tell you what personal data sits behind each of those systems, and why. In practice, for most SMEs the RoPA lives in a spreadsheet that maps activities to purposes, but not to the systems and vendors where the data actually sits. So when a login is compromised, the DPO spends day one emailing around.

The same pattern applies at 800 employees as at 8,000: one person’s sign-on reaching a CRM, a marketing platform, a support desk and a data warehouse, each quietly holding more than anyone wrote down.

Five questions your RoPA should answer in five minutes

Pick an account with broad access (a marketing or analytics login is a good start) and try these now, before you need to.

  1. 01. Which systems could this login reach, and which activities use them? If you can’t connect access to processing, you can’t scope the breach.
  2. 02. Whose data, and which categories? Customers, staff, children, special category data: each changes the risk assessment.
  3. 03. Which countries are affected? Data subjects outside the UK may bring other regulators and notification rules into play.
  4. 04. Should that data still have been there? Retention you can’t justify turns a small breach into a bigger one.
  5. 05. Who owns each system, and is there a DPA? Someone has to call each platform’s provider in the first hour. Who?

What this looks like in practice

Here’s a sample estate for a fictional 800-person retailer, Harbourline Retail, in the PrivacyCulture RoPA Estate View. A marketing analyst has just been tricked into sharing their login, and that account had access to the company’s cloud data warehouse. Make the warehouse the centre of a blast-radius view and everything connected to it lights up, with an incident brief generated alongside.

Sample data for a fictional company, in Blast radius view. Red lines trace everything connected to the platform the stolen login reached; node colour shows each activity’s severity.

In this example, the DPO can see in a minute that the compromised login’s reach into the warehouse touches six processing activities, around 412,000 people in two countries, and one downstream recipient, an ad-audience platform, with no DPA on file. The red node is the other finding that matters: marketing personalisation holds three years of search and browse history. That’s the difference between “contact details” and a behavioural profile, and both were decisions made long before the breach.

Run the drill this week

  1. Pick your three broadest logins. Usually marketing, analytics and customer service accounts, which tend to reach several platforms through one sign-on.
  2. Time yourself on the five questions. If any answer needs an email to a colleague, that’s a gap in your record, not in your memory.
  3. Fix the three usual gaps. Link each activity to the systems it uses, give every record an owner, and challenge any retention period nobody can explain.