Data breaches, cyber security, accountability and applied judgement

Recognise and respond to information incidents, preserve evidence, escalate promptly, support breach assessment and integrate the whole programme through complex scenarios.

• Recognise common forms of personal-data breach beyond hacking.
• Take immediate containment and escalation steps.
• Understand the organisational 72-hour ICO assessment window for notifiable breaches.
• Distinguish personal responsibility from the controller’s formal notification role.
• Use CLEAR to analyse complex incidents involving multiple duties.

A personal-data breach includes accidental or unlawful loss, destruction, alteration, unauthorised disclosure or unauthorised access. Wrong-recipient email, lost paperwork, curiosity access and exposed cloud folders can therefore be breaches even when no hacker is involved.

The first practical priorities are containment, preservation of evidence, prompt internal reporting and accurate facts. Staff should not wait to see whether harm occurs before using the organisation’s incident or IG route.

Controllers assess whether a breach must be reported to the ICO. Where notification is required, it must be made without undue delay and, where feasible, within 72 hours of awareness. High-risk breaches may also require communication to affected individuals.

Individual clinicians usually report internally rather than making an independent regulator notification unless that is part of their organisational role. They should provide enough information for the responsible team to assess risk and meet deadlines.

Accountability means more than completing incident forms. It includes learning from near misses, strengthening controls, documenting decisions, responding to affected people appropriately and avoiding blame-driven concealment.

Use CLEAR consistently across information decisions.

1. Clarify the purpose and recipient.
2. Locate the professional and legal authority.
3. Evaluate necessity, proportionality and the minimum information needed.
4. Ask about consent, objections, capacity, statutory duties or powers, and public-interest factors.
5. Record the reasoning, disclosure, advice and safeguards.

CLEAR is an educational scaffold, not a statutory legal test.

Scenario 1. A discharge letter containing sensitive information is emailed to the wrong patient.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

Scenario 2. A shared folder containing clinic lists is accidentally made publicly accessible for several hours.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

Scenario 3. A clinician realises that a colleague has repeatedly used another person’s login to access records.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

• Only hacking is a data breach.
• If the recipient deletes the email, no incident report is needed.
• Every clinician must report directly to the ICO.
• A near miss does not need governance attention.

• What exactly is the purpose of using or disclosing the information?
• Who is asking, and have I verified identity and role?
• What professional, common-law, statutory and data-protection authority applies?
• Can the purpose be achieved with less or anonymised information?
• Does the patient expect this use, have they consented or objected, and does that matter in this context?
• Is there a nation-specific rule, local policy or specialist route I need to check?
• What should I document, and who should I consult if uncertain?

Optional reflection: Do not enter identifiable patient, colleague or employer information. Identify one situation in your practice where confidentiality, data protection and local governance could easily be conflated. How would CLEAR improve the reasoning?

• Data breaches include accidental disclosure and unauthorised access.
• Containment should begin promptly.
• Preserve evidence and record facts.
• Use the organisation’s incident/IG/cyber route without delay.
• Controllers assess ICO notification.
• Notifiable breaches are generally reported within 72 hours where feasible.
• High-risk breaches may require communication to affected people.
• Staff should not conceal incidents out of fear of blame.
• Near misses can reveal system weaknesses.
• CLEAR can integrate authority, necessity, action and documentation in complex incidents.

Check current versions for time-sensitive decisions.

• R32 - ICO: Personal data breaches: a guideOpen official source
• R9 - GMC: Managing and protecting personal informationOpen official source
• R31 - ICO: Data protection impact assessmentsOpen official source
• R6 - ICO: Data sharing: a code of practiceOpen official source