Data Protection Breach Response Evaluation Form

Please ensure Part A of this form is completed and returned as soon as possible and certainly within 24 hours of discovering the potential breach involving personal data.  When returning the form, please ensure that you copy your email to the head of your school or service area and to your local Data Protection Champion(s).

The University is required by data protection law to report certain types of personal data breaches to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach if it is likely to result in adverse effects on individuals’ rights and freedoms. Where there is a likely high risk of these adverse effects occurring, the University is also required to notify the individuals without delay.  

As the information provided in this form will be used to assess the likelihood and level of risk to individuals, you must complete the form to the best of your ability.

Data protection law defines a personal data breach as, “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.”  Incidents resulting in the temporary loss or unavailability of personal data may still constitute a personal data breach.

PART A: GATHERING THE FACTS

To be completed by the area reporting the data protection breach

Question	Response	
REPORTING THE POTENTIAL BREACH	
Name and job title of the person reporting the incident, and of the person completing this form (if different)		
Organisational unit	(E.g. school/service area and college/support group)	
DISCOVERY OF THE POTENTIAL BREACH	
When did the incident/problem become known?	(Time and date)	
Who initially discovered the incident/problem?	(If the discovery was made by a member of staff, provide name, job title and unit.  If someone else discovered the incident please describe, noting if the incident involves their personal data) 	
How was the incident/problem discovered?	(E.g. Was a complaint received or did a member of staff discover the incident)	
Has a complaint been received from the data subject(s) (i.e. the individual(s) who the information relates to)?		
NATURE AND CIRCUMSTANCES OF THE POTENTIAL BREACH	
Describe in detail the nature of the incident and the circumstances	(When, what, who, summary of incident etc.)	
When did the incident/problem occur?	(Date and time of the incident with as much accuracy as reasonably possible, or the period in which the incident is known to have occurred.)	
Categorise the type of incident/problem	Select/highlight the option that fits most closely:
•	Misdirected communication (e.g. sending an email or letter to the wrong recipients)
•	Mislaid data (e.g. leaving a paper file or portable device in a public place)
•	Theft of device/hardware containing data
•	Premature destruction or deletion of golden copy data contrary to the retention schedule
•	Unauthorised access to data (e.g. through hacking, phishing etc)
•	Unauthorised editing/amendment of data (e.g. by a disgruntled employee)
•	Other: please specify
	
Who are the data subjects?	Select/highlight all categories that apply:
•	Students
•	Staff
•	Research volunteers
•	Applicants to study
•	Job applicants
•	Alumni
•	Other: please specify
	
What format is the data?	Select/highlight all categories that apply:
•	Paper
•	Email with or without an attachment
•	Digital data on a removable/portable device:
o	UoE owned laptop
o	Personally owned laptop
o	UoE owned tablet
o	Personally owned tablet
o	UoE owned smart phone
o	Personally owned smart phone
o	USB drive
o	UoE owned PC
o	Personally owned PC
•	Digital data on UoE server / cloud
•	Digital data on third party server / cloud
•	Other: please specify
	
What are the categories of personal data (provide and any further details)
	Select/highlight all categories that apply:
•	Personal identifiers
o	Name
o	Date of birth
o	Matriculation number
o	Examination number
o	Staff number
o	Other: please specify
•	Contact details
o	Home address
o	Home/personal telephone number
o	Home/personal email address
o	Work address
o	Work telephone number
o	Work email address
o	Other: please specify
•	Financial information
o	Bank details
o	Salary information
o	Other: please specify
•	Progression information
o	Marks / grades
o	Appraisal / annual review information
o	Other: please specify
•	Criminal convictions or offences
•	Special Category  personal data
o	Health (e.g. sickness absence information, including medical certificates; Special circumstances information; Disability information; medical records; and PVG information)
o	Ethnic origin (e.g. staff and student ethnicity information)
o	Political opinions
o	Religious or philosophical beliefs
o	Trade Union membership
o	Sex life or sexual orientation
o	Genetic or biometric data 
•	Other: please specify
	
How many individuals does the incident concern and how many personal data records? 	Give the precise number if possible, otherwise select/highlight from the list.  If relevant, please provide further breakdowns for different types of information (e.g.100 students’ special circumstances records, 10 of which contained information about their mental health).
  
•	0
•	1-4
•	5-9
•	10-49
•	50-999
•	>1,000
	
In addition to the personal data is any other information involved?  E.g. confidential business information		
Has anything similar happened before?
	(Give details)	
ACTIONS TAKEN	
What actions have been taken so far in response to the incident?

If relevant, what is being done to recover the information and/or prevent the further transmission of the information and/or delete the information mistakenly disclosed?
	(E.g. If information was sent electronically to an incorrect recipient(s), have they been asked to delete the information? If a device was lost or stolen and remote wipe is possible, has this been done? If a password has been disclosed, has it been changed?)	
If applicable: what action was taken by the recipient when they inadvertently received the information?		
Have you already notified the data subjects?	(If so, explain how and attach correspondence)	
POLICIES, PROCEDURES AND TRAINING IN PLACE AT THE TIME OF THE INCIDENT	
Describe in as much detail as possible, the safeguards that were in place to protect the data.  Please state if a Data Protection Impact Assessment (DPIA) has been undertaken.  	(E.g. Include details of relevant administrative/procedural measures, e.g. policies, standard operating procedures and working practices, and IT security measures, e.g. encryption)
	
Have the relevant members of staff undertaken data protection training? (provide details)
	(E.g. Have they undertaken the mandatory online Data Protection and Information Security Essentials training courses?)	

PART B: INITIAL ASSESSMENT

To be completed by the Data Protection Officer (DPO) or the Records Management Section (RMS)

When assessing risk, consideration should be given to both the likelihood and severity of the risk to the rights and freedoms of data subjects.  A risk exists when the breach may lead to physical, material or non-material damage for the individuals whose data have been breached.  Where the breach involves special category personal data, criminal convictions and offences or related security measures, such damage should be considered likely to occur.

Taking into account the following issues, assess the likelihood and severity of the risk:

•	Type of breach
•	The nature, sensitivity, and volume of personal data
•	Ease of identification of individuals
•	Severity of consequences for individuals.
•	Special characteristics of the individual
•	Special characteristics of the University
•	The number of affected individuals

Risk	Assessment of Likelihood and Severity	
Discrimination	
	
Loss of control by data subject over their personal data		
Limitation of the data subjects’ rights		
Identity theft or fraud		
Financial loss		
Unauthorised reversal of pseudonymisation		
Damage to data subjects’ reputation		
Loss of confidentiality of personal data		
Other: please specify		

Based on the above assessment, decide the categorisation of the breach.

Decision 		
Breach Categorisation and Assignment	Breach categorised as ‘likely to be notifiable and assigned to the DPO; or
Breach categorised as ‘ unlikely to be notifiable’ and assigned to the RMS
	
Explain the reason for the categorisation*		

PART C: ACTIONS TAKEN AFTER BREACH REPORTED

To be completed by the Data Protection Officer (DPO) or the Records Management Section (RMS)

Action		
Breach notified to the ICO?	Yes/No.  If yes, state date notified.  If no, explain justification for decision	
Data subjects notified?	Yes/No.  If yes, state date notified.  If no, explain justification or decision.	
What further actions were taken in response to the incident?  		
What actions were taken to prevent a similar incident happening again?		
If the breach was notified to the ICO, what was the outcome?		
If data subjects were notified about the breach, what was the outcome? 	(E.g. Complaint(s) submitted to the University or the ICO or legal action taken)	

FOR ADMINISTRATIVE USE

Reference number	E.g. 2020-0001