Leadership in the cyber warfare era: Formulating a data breach reporting and management strategy

Abstract

This paper focuses on one of the fundamental requirements of the General Data Protection Regulation (GDPR), namely the duty to inform data protection regulators and users promptly when there has been breach of user data. It notes that many corporate leaders fear this requirement, which is generally viewed as an unnecessary expense on the organisation. It argues, however, that responsible leaders must embrace this requirement and view it not as a threat but an opportunity to continuously improve their systems. It posits that responsible leaders must not fear this, whether they are governed by the GDPR or not. The paper highlights, with some examples, the major data breaches that have compromised user information in arguing that while investment in robust end-to-end security systems is imperative, it cannot guarantee against data breach due to the increasing sophistication of both state and non-state hackers. It analyses some reasons why many leaders often try to conceal data breach and concludes by proffering some advice, backed by practical examples of how responsible leadership can formulate novel and holistic data breach reporting and management strategies that go beyond the traditional crisis management and continuity models.