Data Breach Notification Policy

Data Breach Notification Policy

Purpose and Scope

This policy sets out [company name]’s approach to identifying, managing, recording, reporting and responding to personal data breaches in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

It applies to all employees, directors, contractors, agents, advisers, and other third parties acting on behalf of [company name] who process or have access to personal data held by the organisation.

Definitions

Personal Data: Any information relating to an identifiable individual.

Personal Data Breach: A breach of security which leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes, but is not limited to, loss of data or devices, system hacks, unauthorised access, disclosure to incorrect recipients, or the accidental publication of personal data.

Responsibilities

Data Protection Officer (DPO) or other designated data protection lead: Oversees breach management, reporting to the ICO and affected individuals as required. [company name]'s DPO can be contacted at [insert dpo or data protection contact details].

Employees and Contractors: Must report all actual or suspected data breaches to the DPO immediately.

If applicable:

Breach Management Team: Provides support to assess and contain breaches.

Reporting a Breach

Internal Reporting

All individuals must report any actual or potential data breach to the DPO without undue delay, and no later than 24 hours after becoming aware of it, regardless of perceived severity.

Third-Party Reporting

Processors acting on behalf of the organisation are required to notify the organisation without undue delay after becoming aware of a personal data breach. If a third party (such as a processor) notifies us of a breach affecting the organisation’s personal data, we will treat this as an internal report and follow the same procedure.

Assessment and Investigation

Upon notification, the DPO (or designated lead) will:

Confirm whether a personal data breach has occurred.

Assess the nature, scope and likely impact of the breach.

Contain and recover personal data, where possible.

Determine whether the breach is notifiable to the Information Commissioner’s Office (“ICO”) and/or affected individuals.

This assessment will include consideration of the likelihood of harm to individuals’ rights and freedoms. Serious or high-risk breaches may be escalated to senior management and, where appropriate, the board of directors.

Notification to the Information Commissioner’s Office

A breach that is likely to result in a risk to individuals’ rights and freedoms must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. If the organisation cannot provide all required information within 72 hours, it will submit what it can and provide the remainder as soon as possible.

Note: For the purposes of this policy, the organisation is considered “aware” of a personal data breach when it has a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised.

Notification to the ICO will include:

This is a preview. The full template is free on GitLaw.