Data breaches

A step-by-step guide for what to do in the event of a data breach.

If you have just become aware of a data breach at your school you need to act quickly. An extract from the ICO Data Breach information has been provided to help you.

GDPR or DPA 2018 personal data breach

A personal data breach is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

If you experience a personal data breach you need to consider whether this poses a risk to people. You need to consider the likelihood and severity of the risk to people’s rights and freedoms, following the breach. When you’ve made this assessment, if it’s likely there will be a risk then you must notify the ICO; if it’s unlikely then you don’t have to report. You do not need to report every breach to the ICO.

Managing a data breach

In the event that the school identifies or is notified of a personal data breach, the following steps should be followed:

1. The person who discovers/receives a report of a breach must inform the Head Teacher or, in their absence, either the Deputy Head Teacher and/or the School’s Data Protection Officer (DPO). If the breach occurs or is discovered outside normal working hours, this should begin as soon as is practicable.
2. The Head Teacher or DPO (or nominated representative) must ascertain whether the breach is still occurring. If so, steps must be taken immediately to minimise the effect of the breach. An example might be to shut down a system, or to alert relevant staff such as the IT technician.
3. The Head Teacher or DPO (or nominated representative) must inform the Chair of Governors as soon as possible. As a registered Data Controller, it is the school's responsibility to take the appropriate action and conduct any investigation.
4. The Head Teacher or DPO (or nominated representative) must also consider whether the Police need to be informed. This would be appropriate where illegal activity is known or is believed to have occurred, or where there is a risk that illegal activity might occur in the future. In such instances, advice from the School’s legal support should be obtained.
5. The Head Teacher or DPO (or nominated representative) must quickly take appropriate steps to recover any losses and limit the damage. Steps might include:

• Attempting to recover lost equipment.
• Contacting the relevant County Council Departments, so that they are prepared for any potentially inappropriate enquiries ('phishing') for further information on the individual or individuals concerned. Consideration should be given to a global email to all school staff. If an inappropriate enquiry is received by staff, they should attempt to obtain the enquirer's name and contact details if possible and confirm that they will ring the individual, making the enquiry, back. Whatever the outcome of the call, it should be reported immediately to the Head Teacher or DPO (or nominated representative).
• Contacting the County Council's Communications Division if part of the crisis service, so that they can be prepared to handle any press enquiries. The Council's Senior Communications Officer can be contacted by telephone: 01629 538234
• The use of back-ups to restore lost/damaged/stolen data.
• If bank details have been lost/stolen, consider contacting banks directly for advice on preventing fraudulent use.
• If the data breach includes any entry codes or IT system passwords, then these must be changed immediately and the relevant agencies and members of staff informed.

Types of breach

Data protection breaches could be caused by a number of factors. A number of examples are shown:

• Loss or theft of pupil, staff or governing body data and/ or equipment on which data is stored.
• Inappropriate access controls allowing unauthorised use.
• Equipment failure.
• Poor data destruction procedures.
• Human error.
• Cyber-attack.
• Hacking.

Notifying other people or agencies

Some people or agencies may need to be notified as part of the initial containment. However, the decision will normally be made once an initial investigation has taken place. The Head Teacher or DPO (or nominated representative) should, after seeking expert or legal advice, decide whether anyone is notified of the breach. In the case of significant breaches, the Information Commissioner's Office (ICO) must be notified within 72 hours of the breach. Every incident should be considered on a case by case basis.

When notifying individuals, give specific and clear advice on what they can do to protect themselves and what the school is able to do to help them. You should also give them the opportunity to make a formal complaint if they wish. The notification should include a description of how and when the breach occurred and what data was involved. Include details of what you have already done to mitigate the risks posed by the breach.

Review and evaluation

Once the initial aftermath of the breach is over, the Head Teacher or DPO (or nominated representative) should fully review both the causes of the breach and the effectiveness of the response to it. It should be reported to the next available Senior Management Team and Full Governors meeting for discussion. If systemic or ongoing problems are identified, then an action plan must be drawn up to put these right. If the breach warrants a disciplinary investigation, the manager leading the investigation should liaise with Human Resources or Internal Audit for advice and guidance. This breach procedure may need to be reviewed after a breach or after legislative changes, new case law or new guidance.

Implementation

The Head Teacher or DPO should ensure that staff are aware of the School’s Data Protection policy and its requirements including this breach procedure. This should be undertaken as part of induction, supervision and ongoing training. If staff have any queries in relation to the School’s Data Protection policy and associated procedures, they should discuss this with their line manager, DPO or the Head Teacher.

Contact us

If you are concerned about a data breach and you purchase the Data Protection Officer service or the Helpline service from the Education Data Hub, you can call on tel: 01629 532888, or by email: DPforSchools@derbyshire.gov.uk

If you don't purchase any support, but require assistance the team may be able to help you and offer consultancy services where appropriate.