Reporting Breaches, Speaking Up, and Learning

A personal data breach is not only hacking. It includes information sent to the wrong person, records lost, a stolen device, unauthorised access, a screen visible to others, paper left in a public area, or patient information altered or deleted by mistake. The main professional duty is to report promptly.

Dental nurses must not attempt to hide, fix, or investigate a data protection issue alone. Prompt reporting lets the practice contain the incident, assess risk, contact the right people, and decide whether the ICO or affected patients need to be informed. Delay can make a small incident harder to manage.

If something goes wrong

• Contain what you can do safely, for example retrieve a paper form or lock a screen.
• Do not delete evidence or change records to minimise the problem.
• Write down factual details: what happened, when, who was affected, and what you did.
• Report immediately to the data lead, manager, dentist, or DPO as the practice policy requires.
• Take part in any learning and improvement activity so the same error is less likely to recur.

Speaking up can feel difficult if the issue involves a senior colleague, a dentist, or the practice owner. Keep the conversation factual and patient-focused: "I am concerned this may be a data protection issue and I think it needs logging." That is calm and professional.

Breach reporting and manager responsibilities

Prompt reporting is protective. It gives the practice the best chance to contain the issue, support the patient, meet legal duties, and learn.