Data Breach Management Policy

What's inside

This policy is fully drafted and structured, ready to brand and complete for your service. It covers:

• 1. Purpose
• 2. Scope
• 3. Policy statement
• 4. Definitions
• 5. Legal and regulatory framework
• 6. Recognising a breach
• 7. Immediate actions and containment
• 8. Reporting and escalation
• 9. Risk assessment of a breach
• 10. Notifying the ICO
• 11. Notifying affected individuals
• 12. The breach register and record-keeping
• 13. Investigation, root cause and lessons learned
• 14. Roles and responsibilities
• 15. Training and awareness
• 16. Monitoring, audit and compliance
• 17. Related documents
• 18. Document control and review

Legislation & standards it maps to

• UK General Data Protection Regulation (UK GDPR), Articles 33 and 34
• Data Protection Act 2018
• Data (Use and Access) Act 2025
• Information Commissioner's Office - Personal data breach guidance
• Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Regulation 17 (Good governance)
• Common Law Duty of Confidentiality
• Caldicott Principles (UK Caldicott Guardian Council)
• Network and Information Systems Regulations 2018 (NIS)
• Computer Misuse Act 1990

Who it applies to

All staff, locums, students, volunteers, contractors and data processors acting on behalf of [Organisation Name]; specific duties for the [Data Protection Officer].

How it works

1. Buy securely with Stripe - instant, no VAT, no account needed.
2. Download your editable Word file from the link we email you straight away.
3. Complete the placeholders for your service, then have it approved before use.
4. Add the optional updates subscription and we keep it current as guidance changes.