Breach triage, ICO decisions, and learning

A personal data breach is a security incident affecting personal data. It can involve accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, or loss of availability. In care settings breaches may be paper, verbal, digital, cyber, supplier-related, or caused by poor access controls.

ICO guidance requires reporting certain personal data breaches to the ICO without undue delay and, where feasible, within 72 hours of becoming aware. If a breach is likely to result in a high risk to people's rights and freedoms, affected individuals must also be informed without undue delay. Managers need a process that supports early reporting, factual triage, risk assessment, and follow-up learning.

Immediate leadership actions

• Contain: recover paperwork, recall email, secure accounts, isolate affected devices, stop further disclosure, or switch to downtime procedures.
• Start a log: record what happened, when it was discovered, what information is involved, who may be affected, and actions taken.
• Assess risk: consider sensitivity, volume, vulnerability, likelihood of misuse, distress, safeguarding risk, financial risk, identity risk, and care impact.
• Escalate: involve the DPO, IG lead, Caldicott/confidentiality lead, senior leadership, supplier, cyber support, commissioner, safeguarding lead, or regulator as appropriate.
• Decide notification: document whether the ICO, affected people, police, local authority, CQC or other regulator, commissioners, or insurers need to be told.
• Learn: record root causes, actions, owners, due dates, staff support, and assurance checks.

What makes care-home breach risk higher?

• Vulnerability: residents may be frail, have cognitive impairment, depend on care, or be at risk from family, financial, or safeguarding harm.
• Sensitivity: care records can reveal health, mental capacity, continence, sexuality, family conflict, finances, religion, end of life wishes, or abuse concerns.
• Context: a small disclosure in a close community can be highly identifying and distressing.
• Availability: losing access to care records or eMAR can affect safe care as well as privacy.

Report early, update later

Breach leadership is not waiting for certainty. Contain, log, assess, escalate, decide, document, and update as facts become clearer.