Data Breach Policy

Introduction

Mind Meaning collects, holds, processes, and, where required and permitted by law, shares personal data. Personal data is a valuable asset that must be protected appropriately.

Every care is taken to protect personal data from accidental or deliberate incidents that could result in a data protection breach. Such breaches may compromise confidentiality, integrity, or availability of information and may result in:

  • Harm to individuals

  • Reputational damage

  • Disruption to service provision

  • Legislative non-compliance

  • Financial loss

Aim

Mind Meaning is required under Data Protection legislation, including the General Data Protection Regulation (GDPR), to maintain a framework that ensures the security of all personal data throughout its lifecycle.

This policy:

  • Sets out procedures for managing data breaches and information security incidents

  • Applies to all personal and special category (sensitive) data, in any format

  • Applies to all staff, volunteers, contractors, consultants, suppliers, and data processors

  • Ensures a consistent and effective response to data breaches

The objective is to contain breaches, minimise risk, secure personal data, and prevent recurrence.

Definitions / Types of Data Breach

A data breach includes both confirmed and suspected incidents where the confidentiality, integrity, or availability of data or systems may be compromised.

Examples include:

  • Loss or theft of confidential data or devices (e.g. laptops, USB sticks, paper records)

  • Equipment theft or failure

  • System failure

  • Unauthorised access to or modification of data

  • Hacking attacks or website defacement

  • Accidental disclosure of sensitive information

  • Human error

  • Fire, flood, or unforeseen events

  • “Blagging” (obtaining information through deception)

Reporting an Incident

All individuals accessing or managing Mind Meaning information must report data breaches immediately.

Reports should be made to:

  • The Data Protection Officer

  • IT Services

Reports must include:

  • Full details of the incident

  • Date and time of occurrence

  • Nature of the data involved

  • Number of individuals affected

Failure to comply with Data Protection legislation may result in disciplinary action.

Containment and Recovery

The Data Protection Officer (DPO) will:

  • Determine whether the breach is ongoing

  • Take immediate steps to contain the breach

  • Assess severity and appoint an investigation lead

Actions may include:

  • Recovering lost data

  • Limiting damage

  • Informing the police where appropriate

  • Seeking expert or senior staff advice

Investigation and Risk Assessment

An investigation will begin immediately and, where possible, within 24 hours.

The investigation will assess:

  • Type and sensitivity of data involved

  • Security measures in place

  • What happened to the data

  • Potential misuse

  • Number of individuals affected

  • Severity and likelihood of harm

  • Wider organisational impact

Notification

The DPO will determine whether the Information Commissioner’s Office (ICO) must be notified within 72 hours.

Considerations include:

  • Risk to individuals’ rights and freedoms

  • Whether notification would help individuals mitigate risk

  • Legal or contractual obligations

  • Risks of over-notification

Affected individuals will be informed without undue delay where there is a high risk, and provided with:

  • Details of the breach

  • Steps taken to reduce risk

  • Advice on protecting themselves

  • Contact details for further information

Evaluation and Response

Following containment, a full review will be conducted to assess:

  • Causes of the breach

  • Effectiveness of the response

  • Need for changes to systems or procedures

This review will consider:

  • How data is stored and transmitted

  • Security weaknesses

  • Staff awareness and training

  • Implementation of a data breach response plan

Policy Review

This policy will be reviewed regularly and updated in line with best practice and legislative changes.

Last reviewed: November 2025.