Data Breach Notification Policy

Data Breach Notification Policy

Purpose and Scope

This policy sets out [company name]’s approach to identifying, managing, recording, reporting and responding to personal data breaches in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

It applies to all employees, directors, contractors, agents, advisers, and other third parties acting on behalf of [company name] who process or have access to personal data held by the organisation.

Definitions

Personal Data: Any information relating to an identifiable individual.

Personal Data Breach: A breach of security which leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes, but is not limited to, loss of data or devices, system hacks, unauthorised access, disclosure to incorrect recipients, or the accidental publication of personal data.

Responsibilities

Data Protection Officer (DPO) or other designated data protection lead: Oversees breach management, reporting to the ICO and affected individuals as required. [company name]'s DPO can be contacted at [insert dpo or data protection contact details].

Employees and Contractors: Must report all actual or suspected data breaches to the DPO immediately.

If applicable:

Breach Management Team: Provides support to assess and contain breaches.

Reporting a Breach

Internal Reporting

All individuals must report any actual or potential data breach to the DPO without undue delay, and no later than 24 hours after becoming aware of it, regardless of perceived severity.

Third-Party Reporting

Processors acting on behalf of the organisation are required to notify the organisation without undue delay after becoming aware of a personal data breach. If a third party (such as a processor) notifies us of a breach affecting the organisation’s personal data, we will treat this as an internal report and follow the same procedure.

Assessment and Investigation

Upon notification, the DPO (or designated lead) will:

Confirm whether a personal data breach has occurred.

Assess the nature, scope and likely impact of the breach.

Contain and recover personal data, where possible.

Determine whether the breach is notifiable to the Information Commissioner’s Office (“ICO”) and/or affected individuals.

This assessment will include consideration of the likelihood of harm to individuals’ rights and freedoms. Serious or high-risk breaches may be escalated to senior management and, where appropriate, the board of directors.

Notification to the Information Commissioner’s Office

A breach that is likely to result in a risk to individuals’ rights and freedoms must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. If the organisation cannot provide all required information within 72 hours, it will submit what it can and provide the remainder as soon as possible.

Note: For the purposes of this policy, the organisation is considered “aware” of a personal data breach when it has a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised.

Notification to the ICO will include:

A description of the nature of the breach, including categories and approximate numbers of individuals and records affected.

Contact details of the DPO or other contact point.

A description of the likely consequences.

A description of the measures taken, or proposed to be taken, to address and mitigate the breach.

Notification to Affected Individuals

Where the personal data breach is assessed to be likely to result in a high risk to the rights and freedoms of individuals, [company name] will notify affected individuals without undue delay. The communication will be written in clear and plain language and include:

The nature of the breach.

Contact details of the DPO or representative.

The likely consequences of the breach.

Measures taken or proposed to mitigate adverse effects.

Notification to affected individuals will not be required where appropriate technical and organisational measures (such as encryption) were in place, or where subsequent measures ensure the high risk is no longer likely to materialise, in accordance with Article 34 UK GDPR.

Record Keeping

All personal data breaches, regardless of whether they require notification to the ICO or individuals, will be recorded in the Data Breach Register, including:

Facts relating to the breach.

Effects of the breach.

Remedial actions taken.

This record will support future review, accountability and compliance audits.

Training and Awareness

[company name] will provide appropriate training on data protection and breach procedures to relevant personnel. Awareness activities will be undertaken periodically to reinforce obligations under this policy.

Review

This policy will be reviewed at least annually or following a significant breach, regulatory change, or organisational change affecting personal data processing.

Policy approved by: ____________________

Date: ____________________

Next Review Due: ____________________