Data Breach Response Services & ICO Support
Practical advice when a data breach happens, providing risk assessment, containment, ICO notifications.
If you’ve experienced a data breach, we’ll help assess the potential risks, determine what your organisation needs to do next and put practical measures in place to reduce the risk of a similar incident happening again.
Talk to us about specialist advice for data breach response & ICO support.
The first few hours matter. You may still be gathering information, but you should start recording what happened, contain the incident where possible and assess the potential impact on the individuals involved. If the breach meets the reporting threshold, the 72-hour reporting period runs from when your organisation becomes aware of it.
Read the ICO guidance on responding to a personal data breach →
Not every data breach needs to be reported to the ICO, but every incident needs to be assessed properly. Where a breach is likely to result in a risk to individuals, the ICO must be notified without undue delay and, where feasible, within 72 hours of the organisation becoming aware of it.
Dealing with a personal data breach?
Download our one-page guide to the first 72 hours.
Download the breach guide →
Clara Westbrook
25+ Years PQE
Founder | Qualified Solicitor | Data Protection Specialist
07976 939 016
Why acting quickly matters
Acting quickly can contain the breach and reduces the changes of it spreading further. This then gives you time to establish what personal data is involved, assess the risk to individuals and decide whether the ICO needs to be notified.
We’ve dealt with breaches where emails containing sensitive personal data have been disclosed to the wrong individuals. In these instances these are reportable. However, you may only become aware of this months or even years after its happened. It’s once your aware that the 72 hour clock starts.
What to expect from our data breach response service
The breaches we deal with vary considerably. Some breaches we deal with can be assessed and dealt with relatively quickly; others require mitigations to be implemented and ongoing monitoring to be put in place.
1
Initial breach assessment
2
Containment and evidence
3
Risk assessment
4
ICO notification decision
5
ICO and individual communications
6
Remediation and lessons learned
The scope depends on the nature and seriousness of the incident. Some organisations need an initial risk assessment and advice on notification, while others require end-to-end support with containment, evidence, ICO reporting, communications with affected individuals and remediation.
Related guidance
Read Personal Data Breach Response: What UK Organisations Should Do in the First 72 Hours → for practical steps on containment, risk assessment, ICO notification and communicating with affected individuals.
How our data breach response service works
1. Establish what happened
We begin by gathering the available facts, including when the incident occurred, when your organisation became aware of it, what personal data is involved and who may have been affected. Where appropriate, we work alongside your IT, security or other relevant teams to mitigate the breach.
2. Assess the risk and reporting obligations
Not every breach we assess needs to be reported to the ICO. The important point is establishing the likely impact on the individuals and recording why the decision to report was made.
3. Manage the response
Where notification is required, we can help prepare the ICO report and communications to affected individuals. We also document the decision-making process and identify practical remedial measures following the incident.
What are the benefits of getting breach advice early?
Early specialist advice can help your organisation contain the incident, and reduce the risk of individuals data being compromised further. Where organisations fail to act appropriately they can face serious fines and may have to provide credit monitoring to those affected which can add additional costs the organisation.
Do all data breaches need to be reported to the ICO?
Not always. If the compromised data does not contain individuals personal details beyond their email address this is considered low risk.
Where notification is required, is if the information contained within the breach could have an adverse effect on those involved such as their home address and date of birth. Where for example political opinion, medical records or sexual orientation is disclosed this then becomes a high risk breach and will need to be dealt with promptly.
Why work with us
With more than 25 years’ experience in data protection and privacy, we’ve dealt with breaches ranging from information being sent to the wrong person through to incidents requiring assessment and notification to the ICO.
We work with HR, IT, security and senior management to establish what happened, assess the risk to those affected and determine what needs to be done.
Our experience means we can help you make an initial assessment, document the decisions made and review the position as further information becomes available.
Get help with a data breach
If you have discovered a personal data breach or are unsure whether an incident needs to be reported, speak directly with a data protection specialist. +44 (0)7976 939 016 (Mon – Fri: 9:00 am – 6:00 pm Sat: 10 – 4 pm).
Send us a short description of what has happened and when your organisation first became aware of it. We will let you know what information we need and the most appropriate next step.
Westbrook Data Protection Services Limited, 2nd Floor, Midas House, 62 Goldsworth Road Woking, Surrey, GU21 6LQ
View our Privacy Policy here
Explore More Data Protection & Privacy Services
Our team have a deep understanding of the following areas of law and continue to add value to our clients’ businesses.
Latest Insights
- The GDPR Accountability Principle: From Paper to Practice
Accountability principle As a new consultant at Westbrook Data Protection Services, one of the first […] - Changes to employment law and the rise in Data Subject Access Requests
Changes to employment law and the rise in Data Subject Access Requests Employment Rights Act […]