- The institution I am working for - in EU member-state A - recently suffered a cyber-attack which led to data being copied from the institution's infrastructure outside of it.
- The offenders asked for ransom to not publish the data, which the institution refused to pay, leading to a data breach.
- We are still waiting (roughly 30 days, now) to be informed by our law department about what exact data have been breached.
- I am working remotely for that institution, residing in EU member-state B for the last 4 years and 4 months.
I am considering to submit a complaint to the corresponding DPA about the breach and the way our institution is/has been handling the situation. Nevertheless, I am not sure to which the "corresponding DPA" in my case is.
- Should I address the DPA of my home country, B, where I stay in, my institution country's DPA, A, or probably both?
- Would it be better if, probably on top of that, I also address some EU body/institution, since more than one member-states are involved?