Examining leaked data does not mean storing it without limit. Purpose, retention and access must be written down up front.
Leaked data contains personal data. Examining it to protect your organisation can rest on a legitimate purpose, but that is not a justification for storing it indefinitely or opening it to everyone.
What to write down first
- Purpose — securing your own staff and systems. Any use beyond that purpose is assessed separately.
- Retention — how long the record is kept after the case closes.
- Access — who can reach the raw record, and logging of that access.
- Minimisation — not storing passwords in plain text, and where a hash is enough for matching.
Third parties' data
A data set contains records of people unrelated to your organisation. Filter those out and do not keep them; you have no legitimate interest in continuing to process non-matching records.
Notifying the individual
If your own employee's credential leaked, assess the notification obligation with your legal team. The notice must state plainly which account the person should change and by when.
