While some may have questioned the point of issuing a monetary penalty against a company that has filed for bankruptcy,23andMe was recently acquired by its founder under a nonprofit structure with binding privacy commitments, meaning that the enforcement may still carry weight. What should you do now? For controllers processing high-risk data, it is clear thatbasic security controls such as multi-factor authentication and breach detection systems are expected, particularly where data is of a kind that individuals cannot replace or revoke. The ICO quoted its own guidance on data security throughout the notice, so would expect that controllers have considered this guidance and the various security measures that it suggests. It is also clear that controllers must be sensitive and investigate appropriately any possible data security breach, particularly where there are warning signs from multiple sources. It is especially important to be set up correctly and be prepared to respond to such incidents, by having a clear data breach response process and investigation team prepared to respond.