YOUR WORKING OUTCOME
Contain the incident, establish the facts and awareness, and make separate, recorded notification decisions.
Set the scope
The recipient, access to the file and consequences are not yet fully known. The response needs an accountable lead and a contemporaneous record.
The example
Illustrative scenario: a member of staff reports sending a file containing customer and health-related information to an unintended external recipient. The scenario does not predetermine whether a real incident is notifiable.
First actions
- Escalate to the incident lead and deputy immediately through the organisation's approved route.
- Take appropriate containment steps and preserve relevant evidence without creating unnecessary further disclosure.
- Record discovery and the facts supporting controller awareness; start considering the notification duties while the investigation continues.
Follow the workflow
Open the record and contain
Record what was reported, by whom and when, the systems involved and initial containment. Preserve relevant logs and messages with appropriate access. Assign a lead, decision authority and next fact-check.
Evidence: Original report, event log and containment actions.Your output: An incident record with named roles and a reliable timeline.What useful evidence might look like
Illustrative: INC-04 records that access to the shared link was revoked, with the time and system evidence.
Establish scope and awareness
Determine whether personal data was affected, whose information, what categories and how confidentiality, integrity or availability changed. Record the evidence for controller awareness separately from initial suspicion and later forensic findings.
Evidence: Access evidence, data categories, affected systems and enquiries.Your output: A factual account that separates known information from assumptions.What useful evidence might look like
Illustrative: the log distinguishes a recipient's deletion assurance from independent evidence about prior access.
Assess the risks to people
Consider sensitivity, identifiability, volume, vulnerable groups, likely misuse, protections and possible harms. Assess likelihood and severity using the actual incident. Reassess as evidence changes and record uncertainty.
Evidence: Risk assessment, relevant specialist advice and updated facts.Your output: A reasoned assessment of risk and high risk.What useful evidence might look like
Illustrative: the assessment considers distress and disclosure of health information as well as financial loss.
Make the regulator notification decision
A controller must notify without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to risk people's rights and freedoms. Record the reasons either way. Where required, make an initial notification with available information and supplement it without undue further delay.
Evidence: Decision, awareness timestamp, notification content and submission evidence.Your output: A regulator decision record and update plan.What useful evidence might look like
Illustrative: the lead records an initial submission reference and the unresolved facts scheduled for an update.
Decide communications and other reports separately
Consider affected-person communication where high risk is likely, subject to the Article 34 conditions. A processor must notify its controller without undue delay. Check contractual, insurance and relevant cybercrime reporting routes; these do not replace the data-protection assessment.
Evidence: Recipient groups, approved wording, role analysis and other reporting obligations.Your output: A communications log with distinct decisions, owners and evidence.What useful evidence might look like
Illustrative: the log records separate decisions for the controller, regulator, affected people and insurer.
ICO: personal data breaches guide (opens in a new tab) · NCSC: report a cyber incident (opens in a new tab) · Report Fraud: cybercrime reporting and Scottish reporting route (opens in a new tab)
Verify recovery and corrective action
Check containment and recovery rather than closing the incident on an assumption. Establish the cause, adjust controls and review staff or supplier processes. Where this is an exercise, mark it as simulated and do not send live notifications.
Evidence: Recovery checks, root-cause findings and tested improvements.Your output: A verified remediation list linked to the incident.What useful evidence might look like
Illustrative: a new recipient-verification step is tested before the corrective action is marked complete.
ICO: accountability and governance (opens in a new tab) · ICO: personal data breaches guide (opens in a new tab)
Keep the record and review the process
Record all personal data breaches and the response, including non-notification reasons. Protect the incident file and review what the organisation learned. Report unresolved issues to the accountable owner.
Evidence: Final record, closure decision, evidence references and outstanding actions.Your output: A complete breach log entry and follow-up review.What useful evidence might look like
Illustrative: INC-04 remains operationally closed but its longer-term access-control action is still tracked.
ICO: personal data breaches guide (opens in a new tab) · ICO: accountability and governance (opens in a new tab)
Decision checkpoints
Is the organisation acting as a processor for the affected data?
If yes: Notify the relevant controller without undue delay and follow the incident-assistance obligations.
If no: Assess the organisation's controller duties for the affected processing.
If uncertain: Establish roles promptly without allowing the uncertainty to delay appropriate escalation.
Is a risk to people's rights and freedoms unlikely?
If yes: Record the evidence supporting a non-notification decision and keep it under review.
If no: Proceed with the regulator-notification assessment and applicable timing.
If uncertain: Investigate urgently, document uncertainty and seek appropriate advice while tracking the awareness timeline.
Is high risk to affected individuals likely?
If yes: Assess communication without undue delay and any applicable Article 34 conditions or exceptions.
If no: Record the reasoning and reassess if the facts change.
If uncertain: Prioritise the information and advice needed to resolve the decision.
Keep the closing record
- Discovery and awareness timeline
- Containment and verified facts
- Risk assessment and updates
- Regulator and individual-notification decisions
- Other reporting and communication evidence
- Recovery, lessons and owned follow-up actions
Escalation and limits
- Deal with immediate safety concerns and an active cyber incident through the appropriate operational response while statutory assessments continue.
- Do not wait for a final forensic report before assessing a notification obligation.
- NCSC reports do not fulfil other legal or regulatory reporting requirements. For cybercrime or fraud, check Report Fraud for England, Wales and Northern Ireland and Police Scotland for Scotland.
- A hypothetical exercise must be clearly labelled and must not result in unintended live regulatory or individual notifications.