Managing data breaches A data breach is a breach of data security that leads to accidental or unlawful destruction, loss, alteration or unauthorised disclosure of personal data. It includes sending emails to the wrong person, carelessness with passwords and leaving personal data on desks. If the breach is likely to put at risk individual’s personal data then within 72 hours of the breach it should be disclosed to the Information Commissioner’s Office using the following link https://report.ico.org.uk/security-breach/. If the breach has put the individual’s data at high risk they should be told about the breach. Responsible Complete Identify who deals with data breaches  Ensure everyone knows who handles data breaches Train everyone on what amounts to a data breach Data breach occurs – immediately notify person responsible for handling breaches Liaise with the appropriate people to minimise the impact of the breach Enter breach details into the breach log (click ‘here’ to access) Make recommendations to a director as to whether the Information Commissioner’s Office should be notified of the breach along with any individuals Notify the ICO of the breach if appropriate within 72 hours Complete the breach log Ensure a discussion about the breaches contained within the breach log is added to any leadership risk review Follow up each breach with processes and learnings to ensure that it doesn’t happen again Review common causes of breaches and address with new processes/training