Guidance on data security breach management (ICO)

Organisations which process personal data must take appropriate measures against unauthorised or unlawful processing and against accidental loss, destruction of or damage to personal data. Many organisations take the view that one of those measures might be the adoption of a policy on dealing with a data security breach.

A Policy should consider:

• Evaluation and response
• Notification of breaches
• Assessing the risks
• Containment and recover

This guidance note sets out some of the things an organisation needs to consider in the event of a security breach. This note is not intended as legal advice, nor is it a comprehensive guide to information security. It should, however, assist organisations in deciding on an appropriate course of action if a breach occurs.

The ICO has produced guidance for organisations on the information it expects to receive as part of a breach notification and on what organisations can expect from the ICO on receipt of their notification. The guidance is available on their website:

http://www.ico.gov.uk/Home/what_we_cover/data_protection/guidance/good_practice_notes.aspx

Source: Information Commisioner Office Guide to Data Security Breaches

http://www.ico.gov.uk/about_us/news_and_views/current_topics/data_security_breaches.aspx