{{org_field_logo}}

{{org_field_name}}

Registration Number: {{org_field_registration_no}}

---

Managing Data Breaches Policy

1. Introduction

Protecting personal and confidential information is of paramount importance in our Home Care Service. This Managing Data Breaches Policy explains how we identify, report, assess, contain, investigate and respond to personal data breaches in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, as amended, including by the Data (Use and Access) Act 2025, and other applicable data protection legislation.

As a registered care service in Scotland, we will also take account of our obligations under the Public Services Reform (Scotland) Act 2010, the Social Care and Social Work Improvement Scotland (Requirements for Care Services) Regulations 2011, applicable Care Inspectorate requirements, and the Health and Social Care Standards.

Our aim is to ensure that any actual or suspected personal data breach is identified and managed without delay; that risks to the rights, freedoms, health, welfare and safety of individuals are properly assessed; that legally required notifications are made within the prescribed timescales; and that appropriate action is taken to contain the breach, minimise harm and prevent recurrence.

The service recognises that information relating to people receiving care may include health information and other special category personal data and may therefore be particularly sensitive. All staff must treat any actual or suspected compromise of such information seriously and follow this policy immediately.

2. Purpose

This policy outlines our approach to:

• Recognising and reporting data breaches swiftly and accurately.
• Containing and investigating the breach to minimise its impact.
• Notifying affected parties and relevant authorities as required by law.
• Learning from the breach to prevent recurrence.

By following these steps, we comply with our legal obligations and maintain high standards of data governance, in line with both the Health and Social Care Standards and wider data protection legislation.

3. Scope

This policy applies to:

• All staff (including employees, contractors, agency workers, and volunteers) who handle or access personal data.
• All types of personal data, whether stored electronically (e.g., on computers, smartphones) or physically (e.g., paper records, files).
• All systems used by our Home Care Service, including internal databases, emails, messaging applications, and cloud-based solutions.

4. Definition of a Data Breach

A data breach is any security incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. This includes, but is not limited to:

• Loss or theft of devices (e.g., laptops, mobile phones, USB drives) containing personal information.
• Email sent to the wrong recipient, revealing personal information.
• Hacking or malicious software attacks on data storage systems.
• Unauthorised access to physical records or electronic systems.
• Human error, such as misplacing paper records in an unsecured location.

5. Immediate Response to a Suspected Breach

5.1 Recognising a Breach

All staff must be vigilant in spotting potential data breaches. Examples include receiving an email attachment containing personal data meant for someone else, or discovering that sensitive documents are missing or have been accessed without proper authorisation. Staff should:

1. Stop and assess the situation immediately.
2. Notify their line manager or the designated Data Protection Lead as soon as possible.

5.2 Containment and Recovery

Once a breach is suspected or identified, the key priority is to contain it and minimise any harm. Actions may include:

• Disconnecting or isolating compromised devices or systems from the network.
• Retrieving misdirected emails, letters, or records if possible.
• Securing physical files in locked cabinets or sealed storage areas.
• Temporarily suspending user accounts or changing passwords if unauthorised access is suspected.

The Data Protection Lead (or assigned manager) coordinates the immediate actions necessary to reduce risk and prevent further damage.

6. Internal Reporting and Investigation

6.1 Reporting Channels

All staff must report any actual or suspected personal data breach immediately to their line manager and the Data Protection Lead or other person designated by the organisation to manage data protection incidents.

Staff must not delay reporting while attempting to investigate the incident themselves or while waiting to establish whether harm has occurred.

The Data Protection Lead will ensure that each actual or suspected breach is recorded promptly in the Data Breach Register and assessed to determine whether a personal data breach has occurred.

Where applicable, the initial record must include:

• the date and time the incident occurred, if known;
• the date and time the incident was discovered;
• the date and time the organisation became aware that a personal data breach had occurred;
• the person who reported or discovered the incident;
• a description of the nature and circumstances of the breach;
• the categories of personal data involved;
• whether special category personal data or other particularly sensitive information is involved;
• the categories and approximate number of individuals affected, where possible;
• the categories and approximate number of personal data records affected, where possible;
• how the breach was detected;
• the systems, devices, paper records or other information assets affected;
• the actual or likely consequences of the breach;
• the immediate containment and recovery measures taken;
• the outcome of the risk assessment;
• whether notification to the Information Commissioner is required;
• whether communication to affected individuals is required;
• details and dates of any notifications made;
• the reasons for any decision not to notify the Information Commissioner or affected individuals; and
• the remedial and preventative action taken following the breach.

The record must be updated as further information becomes available.

6.2 Investigation Process

The Data Protection Lead, or another appropriately authorised senior person, will oversee the investigation of the incident.

The investigation must, as appropriate:

1. establish what happened and when;
2. identify the personal data and individuals affected;
3. establish whether personal data has been destroyed, lost, altered, disclosed without authorisation, accessed without authorisation or otherwise compromised;
4. determine whether the breach is continuing and take immediate steps to contain it;
5. assess the likely consequences for affected individuals;
6. assess the likelihood and severity of any risk to the rights and freedoms of affected individuals;
7. determine whether notification to the Information Commissioner is legally required;
8. determine whether affected individuals must be informed;
9. identify the underlying cause of the incident;
10. identify and implement remedial and preventative measures; and
11. consider whether any additional notification or escalation is required under applicable care-service, safeguarding, contractual or other legal requirements.

The investigation and risk assessment must not unnecessarily delay a legally required notification to the Information Commissioner.

Where all required information is not yet available, the Data Protection Lead must consider making the required notification within the statutory timescale and providing further information in phases without undue further delay.

7. Notification and Escalation

7.1 Reporting Personal Data Breaches to the Information Commissioner

Where the service is acting as a data controller, the Data Protection Lead must assess each confirmed personal data breach to determine whether it is likely to result in a risk to the rights and freedoms of individuals.

Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, the service must notify the Information Commissioner without undue delay and, where feasible, no later than 72 hours after becoming aware of the personal data breach.

A personal data breach does not have to be notified to the Information Commissioner where it is unlikely to result in a risk to the rights and freedoms of individuals. The assessment and the reasons for the decision must be documented in the Data Breach Register.

Where a notification is required, it must, so far as the information is available:

• describe the nature of the personal data breach, including, where possible, the categories and approximate number of affected individuals;
• describe, where possible, the categories and approximate number of personal data records affected;
• provide the name and contact details of the Data Protection Officer, where one has been appointed, or another contact point from whom further information can be obtained;
• describe the likely consequences of the personal data breach; and
• describe the measures taken or proposed to address the personal data breach, including, where appropriate, measures intended to mitigate its possible adverse effects.

If all of the required information is not available at the same time, the available information must be provided within the required timescale and the remaining information may be provided in phases without undue further delay.

Where a notification is made more than 72 hours after the service became aware of the breach, the notification must include reasons for the delay.

The Data Protection Lead will retain evidence of:

• when the organisation became aware of the personal data breach;
• the risk assessment undertaken;
• the decision whether or not to notify the Information Commissioner;
• the date and content of any notification; and
• where applicable, the reason why notification was not made within 72 hours.

The service will co-operate with the Information Commissioner in relation to any subsequent enquiries, investigation or regulatory action.

7.2 Where We Act as a Data Processor

Where the service processes personal data on behalf of another data controller and is therefore acting as a data processor in relation to the affected information, the service must notify the relevant data controller without undue delay after becoming aware of a personal data breach.

The notification must be made promptly enough to enable the controller to meet its own legal obligations, including, where applicable, its obligation to notify the Information Commissioner within the statutory timescale.

The service must follow any additional breach-reporting requirements contained in the applicable data-processing agreement or contract, provided that doing so does not prevent compliance with applicable data protection law.

The processor-to-controller requirement is expressly imposed by Article 33(2).

7.3 Informing Affected Individuals

Where a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, the service must communicate the personal data breach to the affected individuals without undue delay, unless a lawful exception applies.

The communication must be written or provided in clear and plain language and must include at least:

• a description of the nature of the personal data breach;
• the name and contact details of the Data Protection Officer, where one has been appointed, or another appropriate contact point from whom further information can be obtained;
• a description of the likely consequences of the personal data breach; and
• a description of the measures taken or proposed to address the breach, including, where appropriate, measures intended to mitigate its possible adverse effects.

Where appropriate, the communication should also clearly explain practical steps that the individual can take to protect themselves from potential harm.

Direct communication to affected individuals is not required under Article 34 where:

• appropriate technical and organisational protection measures were applied to the affected personal data and those measures rendered the information unintelligible to anyone not authorised to access it, for example effective encryption;
• subsequent measures have been taken which ensure that the high risk to affected individuals is no longer likely to materialise; or
• contacting the affected individuals individually would involve disproportionate effort, in which case a public communication or similarly effective measure must instead be used to inform them.

Any decision to rely on one of these exceptions must be documented.

Article 34 contains both the high-risk threshold and these limited exceptions.

7.4 Notification to the Care Inspectorate and Other Relevant Bodies

A personal data breach does not automatically replace or remove any separate reporting obligation that applies to the service as a registered care service.

The Registered Manager or other authorised senior person must consider whether the circumstances giving rise to the personal data breach also constitute an incident that must be notified to the Care Inspectorate under the notification requirements applicable to the registered service.

Where a Care Inspectorate notification is required, it must be submitted using the current Care Inspectorate notification process and within any applicable reporting timescale.

Where the incident raises an adult protection, criminal, professional registration, contractual or other statutory reporting requirement, the Registered Manager must ensure that the appropriate body is notified in accordance with the applicable procedure.

Notification to the Care Inspectorate does not replace notification to the Information Commissioner where notification to the Information Commissioner is required under data protection legislation, and notification to the Information Commissioner does not replace any separate Care Inspectorate notification requirement.

8. Post-Breach Actions and Preventative Measures

8.1 Lessons Learned and Remedial Action

Following a personal data breach, the Data Protection Lead and relevant senior managers must ensure that proportionate remedial action is identified and implemented.

Depending on the circumstances, this may include:

• correcting or recovering inaccurate, altered or lost information where possible;
• recovering or securely deleting information sent to an unauthorised recipient, where possible;
• changing passwords, credentials or access permissions;
• removing inappropriate access rights;
• applying security updates or other technical measures;
• reviewing physical security arrangements;
• reviewing data-sharing arrangements;
• reviewing relevant contracts and processor arrangements;
• amending policies, procedures or working practices;
• providing targeted staff instruction, supervision or retraining; and
• taking any other proportionate measure required to reduce the likelihood or impact of recurrence.

Where weaknesses in systems, procedures, training, supervision or organisational controls contributed to the breach, appropriate corrective action must be recorded, allocated to a responsible person and followed through to completion.

8.2 Documentation and Data Breach Register

The service must document all personal data breaches in accordance with applicable data protection legislation, including breaches that do not meet the threshold for notification to the Information Commissioner.

The Data Breach Register must contain sufficient information to document:

• the facts relating to the personal data breach;
• the effects and actual or likely consequences of the personal data breach; and
• the remedial action taken.

The record must also contain sufficient information to demonstrate how the service reached its decision about whether notification to the Information Commissioner and communication to affected individuals were required.

Suspected incidents must be recorded while they are being assessed. Where an incident is subsequently determined not to constitute a personal data breach, that outcome must be recorded clearly.

The Data Breach Register and associated investigation records must be retained securely, with access limited to authorised persons, in accordance with the organisation’s applicable records management and retention arrangements.

The records must be made available to the Information Commissioner where lawfully required for the purpose of demonstrating compliance.

9. Staff Guidance and Responsibilities

9.1 Training and Awareness

We ensure that:

• All staff receive initial and ongoing training regarding data protection, information governance, and recognising data breaches.
• Refresher courses are offered periodically and after any serious breach.
• Specialist training is provided to those in roles with higher data risk (e.g., administrators, managers).

9.2 Individual Obligations

Every staff member is responsible for safeguarding personal data in their possession or under their control. They must:

• Adhere to password policies and device encryption where required.
• Secure records and files, both physically and electronically.
• Report any suspected or actual data incidents promptly.
• Only access or share personal data if authorised and it is necessary for their role.

10. Monitoring and Compliance

10.1 Policy Review

Senior management will review this policy at least annually and sooner where required because of a relevant change in legislation, regulatory requirements, Information Commissioner guidance, Care Inspectorate requirements, organisational arrangements or learning arising from an incident or personal data breach.

Any material changes will be communicated to relevant staff, and associated procedures, training and documentation will be updated where necessary.

10.2 Audit and Assurance

We carry out regular internal audits of our data handling processes and systems to ensure ongoing adherence to this policy.

---

Responsible Person: {{org_field_registered_manager_first_name}} {{org_field_registered_manager_last_name}}
Reviewed on: {{last_update_date}}
Next Review Date: {{next_review_date}}
Copyright © {{current_year}} – {{org_field_name}}. All rights reserved.