Data Protection Breach Policy
Soroptimist International of Coventry (“we”, “us”) hold and process personal data which needs to be protected. Every care is taken to protect the data we hold. Compromise of information, confidentiality, integrity or availability may result in harm to individuals, reputational damage, and detrimental effect on service provision, legislative non-compliance and financial penalties.
This policy sets out the procedure to be followed to ensure a consistent and effective approach throughout the organisation.
The policy relates to all personal data held by us, regardless of format. It applies to anyone who handles this personal data, including those working on our behalf. The objective of the policy is to contain any breaches, to minimise the risks associated with the breach and to consider what action is necessary to secure personal data and prevent any further breach.
Types of breach
An incident is an event or action which may compromise the confidentiality, integrity or availability of systems or data, either accidentally or deliberately, and has caused or has the potential to cause damage to data subjects.
An incident includes but is not restricted to:
- Loss or theft of personal data or the equipment on which the data is stored e.g. laptop, memory stick, smartphone, or paper record.
- Theft or failure of equipment on which personal data is stored
- Unauthorised use of or access to personal data
- Attempts to gain unauthorised access to personal data
- Unauthorised disclosure of personal data
- Website defacement
- Hacking attack
Reporting an incident
Any person using personal data on behalf of the club is responsible for reporting data breach incidents immediately to the Secretary or President.
The report should contain the following details:
- Date and time of discovery of breach.
- Details of person who discovered the breach.
- The nature of the personal data involved.
- How many data subjects’ data is affected.
Containment and recovery
The Secretary or President will first ascertain if the breach is still occurring. If so, appropriate steps will be taken immediately to minimise the effects of the breach. An assessment will be carried out to establish the severity of the breach and the nature of further investigation required. Consideration will be given as to whether the police should be informed. Advice from appropriate experts will be sought if necessary. A suitable course of action will be taken to ensure a resolution to the breach.
Investigation and risk assessment
An investigation will be carried out without delay and where possible within 24 hours of the breach being discovered. The Executive Committee will assess the risks associated with the breach, the potential consequences for the data subjects, how serious and substantial those are and how likely they are to occur.
The investigation will take into account the following:
- The type of data involved and its sensitivity.
- The protections in place (e.g. encryption).
- What has happened to the data.
- Whether the data could be put to illegal or inappropriate use.
- Who the data subjects are, how many are involved, and the potential effects on them.
- Any wider consequences.
The Secretary or President will decide with appropriate advice who needs to be notified of the breach. Every incident will be assessed on a case by case basis. Consideration will be given to notifying the Information Commissioner if a large number of people are affected or the consequences for the data subjects are very serious. Guidance on when and how to notify the ICO is available on their website:
Notification to the data subjects whose personal data has been affected by the incident will include a description of how and when the breach occurred, and the nature of the data involved. Specific and clear advice will be given on what they can do to protect themselves and what has already been done to mitigate the risks. The Executive Committee will keep a record of all actions taken in respect of the breach.
Evaluation and response
Once the incident is contained, the Executive Committee will carry out a review of the causes of the breach, the effectiveness of the response, and whether any changes to systems, policies or procedures should be undertaken. Consideration will be given to whether any corrective action is necessary to minimise the risk of similar incidents occurring.