So far, Mike has discovered the criminal could have accessed the full names, addresses, and email addresses of his recent customers.

Luckily, he has a policy that all customer contact details are deleted after three months. This limits what the hacker was able to find out.

Policies like these are useful in the event of a data breach. Even if we’re fairly secure, it’s always best to prepare.

Mike discovers there are twenty-six people in his contacts list, including his customers.

In the UK, where he lives, all serious data breaches must be reported to the ICO within 72 hours of being discovered.

“ICO” stands for the Information Commissioner’s Office. It’s their job to enforce data protection laws in the UK. Other countries have similar organisations.