Data Breach Response Procedure

1. Report immediately

Any member of staff who suspects a personal data breach (for example a lost device, an email sent to the wrong person or unauthorised access) reports it immediately to the person responsible for data protection and a director.

2. Contain

Revoke access, reset credentials, recall or delete misdirected information and preserve evidence, including audit logs.

3. Assess

Establish what data, how many people and the likely risk to their rights and freedoms.

4. Notify

• Report to the Information Commissioner’s Office within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals.
• Tell affected individuals without undue delay when the risk is high, explaining what happened and what they can do.
• Inform affected employers or partners where their data is involved.

5. Record and learn

Every breach, including those not reported to the ICO, is recorded in the breach log with facts, effects and remedial action. Management reviews each incident and updates controls and training.