{"content":{"layouts":[{"type":"singleColumn","areas":[{"items":[{"type":"Plain","cta":"","body":"\u003Cp\u003EFollowing the implementation of the Data (Use and Access) Act this toolkit is under review and will be updated over the coming months. For more information about the Data (Use and Access) Act\u0026nbsp;please\u00A0\u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-what-does-it-mean-for-organisations/\u0022 target=\u0022_blank\u0022 title=\u0022The Data Use and Access Act 2025 (DUAA) - what does it mean for organisations? | ICO\u0022\u003Esee the ICO guidance\u003C/a\u003E.\u003C/p\u003E","link":null,"colour":"#006ddf","title":"","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Cp\u003EThe Trustee Board is responsible for the security, integrity and confidentiality of all the data it holds. The Trustee Board is also obliged under GDPR to keep personal data safe and secure and respond promptly and appropriately to any data security breaches. Although all adult volunteers have a responsibility for the information they generate, manage, transmit and use in line with GDPR, it is the Trustee Board\u2019s legal duty to secure personal and confidential data at all times.\u003C/p\u003E\n\u003Cp\u003EAny person who knows or suspects that a breach of data security has occurred should report the breach immediately according to their Scout Unit\u2019s Data Breach Response Plan. We have included some concepts that you may wish to include in your Local Data Breach Response Plan.\u003C/p\u003E\n\u003Cp\u003EIt\u0027s vital that prompt action is taken in the event of any actual, potential or suspected breach of data security or confidentiality to avoid the risk of harm to young people or adult volunteers, damage to the Scouts operations and severe financial, legal and reputational costs to the Movement as a whole.\u003C/p\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EWhat is a personal Data Breach?\u003C/h4\u003E\n\u003Cp\u003EA data breach is any event that has the potential to affect the confidentiality, integrity or availability of personal data held by the Local Scout Unit in any format. Personal data security breaches can happen for a number of reasons, including:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe disclosure of confidential data to unauthorised individuals\u003C/li\u003E\n\u003Cli\u003EThe loss or theft of portable devices or equipment containing identifiable personal, confidential or sensitive data e.g. PCs, USB, mobile phones, laptops, disks etc\u003C/li\u003E\n\u003Cli\u003EThe loss or theft of paper records\u003C/li\u003E\n\u003Cli\u003EInappropriate access controls allowing unauthorised use of information\u003C/li\u003E\n\u003Cli\u003EA suspected breach of the IT security\u003C/li\u003E\n\u003Cli\u003EAttempts to gain unauthorised access to computer systems, e.g. hacking\u003C/li\u003E\n\u003Cli\u003ERecords altered or deleted without authorisation from the data \u2018owner\u2019\u003C/li\u003E\n\u003Cli\u003EViruses or other security attacks on IT equipment systems or networks\u003C/li\u003E\n\u003Cli\u003EBreaches of physical security e.g. forcing of doors or windows into secure room or filing cabinet containing confidential information\u003C/li\u003E\n\u003Cli\u003EConfidential information left unlocked in accessible areas\u003C/li\u003E\n\u003Cli\u003EThe insecure disposal of confidential paper waste\u003C/li\u003E\n\u003Cli\u003ELeaving IT equipment unattended when logged in to a user account without locking the screen to stop others accessing information\u003C/li\u003E\n\u003Cli\u003EThe publication of confidential data on the internet in error and accidental disclosure of passwords\u003C/li\u003E\n\u003Cli\u003EMisdirected emails or faxes containing identifiable personal, confidential or sensitive data\u003C/li\u003E\n\u003C/ul\u003E","gtmId":"","gtmClass":""},{"gridType":"RichTextBlock","content":"\u003Ch4\u003EHow to respond to a data breach\u003C/h4\u003E\n\u003Cp\u003EIn line with best practice, these five steps should be followed when responding to a data breach:\u003C/p\u003E\n\u003Col\u003E\n\u003Cli\u003EIdentification and initial assessment\u003C/li\u003E\n\u003Cli\u003EContainment and recovery\u003C/li\u003E\n\u003Cli\u003ERisk Assessment\u003C/li\u003E\n\u003Cli\u003ENotification\u003C/li\u003E\n\u003Cli\u003EEvaluation and response\u003C/li\u003E\n\u003C/ol\u003E","gtmId":"","gtmClass":""},{"gridType":"accordion","gtmId":"","gtmClass":"","showExpand":true,"items":[{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003ETo assist this process a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/lk3lygok/data-breach-notification-form.docx\u0022 target=\u0022_blank\u0022 title=\u0022Data Breach Notification form\u0022\u003EData Breach Notification Form\u003C/a\u003E is available. This form will help the Trustee Board to conduct an initial assessment of the incident by establishing if a personal data breach has taken place, and if so:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EWhat personal data is involved in the breach\u003C/li\u003E\n\u003Cli\u003EThe cause of the breach\u003C/li\u003E\n\u003Cli\u003EThe extent of the breach, i.e. how many individuals are affected\u003C/li\u003E\n\u003Cli\u003EThe harms to affected individuals that could potentially be caused by the breach\u003C/li\u003E\n\u003Cli\u003EHow the breach can be contained\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe Trustee Board can determine the severity of the incident using the reference to decide if the incident can be managed and controlled locally or if it is necessary to escalate the incident to the Information Commissioner\u2019s Office (ICO).\u003C/p\u003E","label":"1: Identification and initial assessment"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EOnce it has been established that a data breach has occurred, the Trustee Board needs to take immediate and appropriate action to limit the breach;\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EEstablish who within the Local Scout Unit needs to be made aware of the breach and inform them of what they are expected to do to contain the breach (for example finding a lost piece of equipment, requesting deletion and confirmation of an email from the wrong recipient, isolating/closing a compromised section of the network, etc)\u003C/li\u003E\n\u003Cli\u003EEstablish whether there is anything that can be done to recover any losses and limit the damage the breach can cause (for example physical recovery of equipment/records, the use of back-ups to restore lost/damaged data)\u003C/li\u003E\n\u003Cli\u003EEstablish if it is appropriate to notify affected individuals immediately (for example where there is a high level of risk of serious harm to individuals)\u003C/li\u003E\n\u003Cli\u003EWhere appropriate (for example in cases involving theft or other criminal activity), inform the police.\u003C/li\u003E\n\u003C/ul\u003E","label":"2: Containment and recovery"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EIn assessing the risk arising from a data breach, the relevant Trustee Board are required to consider the potential adverse consequences for individuals, i.e. how likely are adverse consequences to materialise and, if so, how serious or substantial are they likely to be. The information provided on the \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/lk3lygok/data-breach-notification-form.docx\u0022 target=\u0022_blank\u0022 title=\u0022Data Breach Notification form\u0022\u003EData Breach Notification Form\u003C/a\u003E will help with this stage.\u003C/p\u003E\n\u003Cp\u003EThe Trustee Board should review the incident report to:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EAssess the risks and consequences of the breach.\u003C/li\u003E\n\u003Cli\u003ERisks for individuals.\u003C/li\u003E\n\u003Cli\u003EWhat are the potential adverse consequences for individuals?\u003C/li\u003E\n\u003Cli\u003EHow serious or substantial are these consequences?\u003C/li\u003E\n\u003Cli\u003EHow likely are they to happen?\u003C/li\u003E\n\u003Cli\u003ERisks for the Local Scout Unit or Country.\n\u003Cul\u003E\n\u003Cli\u003EStrategic and operational.\u003C/li\u003E\n\u003Cli\u003ECompliance/legal.\u003C/li\u003E\n\u003Cli\u003EFinancial.\u003C/li\u003E\n\u003Cli\u003EReputational.\u003C/li\u003E\n\u003C/ul\u003E\n\u003C/li\u003E\n\u003Cli\u003EConsider what type of data is involved, how sensitive is it? Were there any protections such as encryption? What has happened to the data? If data has been stolen it could be used for purposes which are harmful to the individuals to whom the data relate; if it has been damaged this poses a different type and level of risk.\u003C/li\u003E\n\u003Cli\u003EConsider how many individuals\u2019 personal data are affected by the breach. It is not necessarily the case that the bigger risks will accrue from the loss of large amounts of data but is certainly an important determining factor in the overall risk assessment.\u003C/li\u003E\n\u003Cli\u003EConsider the individuals whose data has been breached. Whether they are young people or adult volunteers will to some extent determine the level of risk posed by the breach and therefore, the actions in attempting to mitigate those risks.\u003C/li\u003E\n\u003Cli\u003EConsider what harm can come to the affected individuals. Are there risks of physical safety or reputation, of financial loss or a combination?\u003C/li\u003E\n\u003Cli\u003EConsider if there are wider consequences to consider such as a loss of public confidence in Scouting as a whole.\u003C/li\u003E\n\u003Cli\u003EDetermine, where appropriate, what further remedial action should be taken on the basis of the incident report to mitigate the impact of the breach and prevent repetition.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe Trustee Board should prepare an incident report setting out (where applicable):\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EA summary of the security breach\u003C/li\u003E\n\u003Cli\u003EThe people involved in the security breach (such as young people, adult volunteers)\u003C/li\u003E\n\u003Cli\u003EDetails of the information, IT systems, equipment or devices involved in the security breach and any information lost or compromised as a result of the incident\u003C/li\u003E\n\u003Cli\u003EHow the breach occurred\u003C/li\u003E\n\u003Cli\u003EActions taken to resolve the breach\u003C/li\u003E\n\u003Cli\u003EImpact of the security breach\u003C/li\u003E\n\u003Cli\u003EUnrealised, potential consequences of the security breach\u003C/li\u003E\n\u003Cli\u003EPossible courses of action to prevent a repetition of the security breach\u003C/li\u003E\n\u003Cli\u003ESide effects, if any, of those courses of action\u003C/li\u003E\n\u003Cli\u003ERecommendations for future actions and improvements in data protection as relevant to the incident\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EThe incident report will then be used to update the risk registers at the appropriate levels where necessary. Any significant risks will be reported and managed via the Risk Register.\u003C/p\u003E\n\u003Cp\u003EWe have provided a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/r2nhpvr0/template-risk-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Risk Register template\u0022\u003Etemplate Risk Register\u003C/a\u003E.\u003C/p\u003E","label":"3: Risk assessment"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003EOn the basis of the evaluation of risks and consequences the Trustee Board, and others involved in the incident as appropriate, will determine whether it is necessary to notify the breach to others outside the Local Scout Unit. For example:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EParents\u003C/li\u003E\n\u003Cli\u003EIndividuals (data subjects) affected by the breach\u003C/li\u003E\n\u003Cli\u003EThe Information Commissioner\u2019s Office\u003C/li\u003E\n\u003Cli\u003EPolice\u003C/li\u003E\n\u003Cli\u003EThe press/media via the UK HQ media team\u003C/li\u003E\n\u003Cli\u003EInsurers\u003C/li\u003E\n\u003Cli\u003EBank or credit card companies\u003C/li\u003E\n\u003Cli\u003EExternal legal advisers\u003C/li\u003E\n\u003Cli\u003EOther regulatory bodies such as the Charity Commission\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EAs well as deciding who to notify, the Trustee Board must consider:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EWhat is the message that needs to be communicated?\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIn each case, the notification should include as a minimum:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EA description of how and when the breach occurred;\u003C/li\u003E\n\u003Cli\u003EWhat data was involved; and\u003C/li\u003E\n\u003Cli\u003EWhat action has been taken to respond to the risks posed by the breach.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EWhen notifying individuals, the Trustee Board should give specific and clear advice on what steps they can take to protect themselves, what the Local Scout Unit is willing to do to assist them and details of how they can contact the Trustee Board for further information.\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EHow to communicate the message?\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EWhat is the most appropriate method of notification (for example are there large numbers of people involved? Does the breach involve sensitive data? Is it necessary to write to each individual affected? Is it necessary to seek legal advice on the wording of the communication?)\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EWhy are we notifying?\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003ENotification should have a clear purpose, for example to enable individuals who may have been affected to take steps to protect themselves (e.g. by cancelling a credit card or changing a password), to allow regulatory bodies to perform their functions, provide advice and deal with complaints, etc.\u003C/p\u003E\n\u003Cp\u003EThe Information Commissioner\u2019s Office (ICO) expects that serious breaches should be brought to their attention within 72 hours of knowing about the breach. Serious breaches are not defined but \u003Ca rel=\u0022noopener\u0022 href=\u0022https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/\u0022 target=\u0022_blank\u0022 title=\u0022ICO data breach reporting guidance\u0022\u003Eguidance is available from the ICO\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003EAny contact with the ICO should be made through the Trustee Board. Initial contact with the ICO should be made by the Trustee Board, outlining the circumstances surrounding the incident through submission of the Breach Notification Form and the Breach Severity Form. The ICO will make a determination regarding the need for a detailed report and/or subsequent investigation based on the nature of the incident and the presence or otherwise of appropriate physical or technological security measures to protect the data. In cases where the decision is made by the Trustee Board not to report a breach, a brief summary of the incident with an explanation of the basis for not informing the ICO will be retained by the Trustee Board.\u003C/p\u003E\n\u003Cp\u003EWhen the personal data breach is likely to result in a high risk to the rights and freedoms of those affected, the Trustee Board shall communicate the personal data breach to the data subject without undue delay.\u003C/p\u003E\n\u003Cp\u003EThe communication to the data subject referred to in paragraph one shall describe in clear and plain language the nature of the personal data breach and contain at least the information and measures referred to above.\u003C/p\u003E\n\u003Cp\u003EThe communication to the data subject shall not be required if any of the following conditions are met:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EThe Trustee Board has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption\u003C/li\u003E\n\u003Cli\u003EThe Trustee Board has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects is no longer likely to materialise\u003C/li\u003E\n\u003Cli\u003EIt would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.\u003C/li\u003E\n\u003C/ul\u003E\n\u003Cp\u003EIf the Trustee Board has not already communicated the personal data breach to the data subject, the ICO, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so or may decide that any of the conditions referred to are met.\u003C/p\u003E\n\u003Cp\u003EIn addition, the completed \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/lk3lygok/data-breach-notification-form.docx\u0022 target=\u0022_blank\u0022 title=\u0022Data Breach Notification Form\u0022\u003EData Breach Notification Form\u003C/a\u003E should be passed to the Scouts UK headquarters via the following email address \u003Ca href=\u0022mailto:dpa.alert@scouts.org.uk\u0022\u003Edpa.alert@scouts.org.uk\u003C/a\u003E.\u003C/p\u003E\n\u003Cp\u003ENOTE \u2013 This email address is only for reporting a breach and there will be no remediation guidance as a direct result. The information will be used by the Scouts to monitor any trends in breaches being reported and update the Scout Unit Data protection Toolkit with further guidance.\u003C/p\u003E","label":"4: Notification"},{"gridType":"accordionItem","gtmId":"","gtmClass":"","body":"\u003Cp\u003ESubsequent to a data breach, the Trustee Board will conduct a review to ensure that the steps taken during the incident were appropriate and to identify areas that may need to be improved.\u003C/p\u003E\n\u003Cp\u003EThe Trustee Board will compile a central record of incidents. To assist with this we have produced a \u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/r4ghmdbe/template-data-breach-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Data Breach Register template\u0022\u003ETemplate Data Breach Register\u003C/a\u003E. The Trustee Board will report on incidents to the adult volunteers in order to identify lessons to be learned, patterns of incidents and evidence of weakness and exposures that need to be addressed.\u003C/p\u003E\n\u003Cp\u003EFor each serious incident, the Trustee Board will conduct a review and report:\u003C/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EWhat action needs to be taken to reduce the risk of future breaches and minimise their impact\u003C/li\u003E\n\u003Cli\u003EWhether policies procedures or reporting lines need to be improved to increase the effectiveness of the response to the breach\u003C/li\u003E\n\u003Cli\u003EIf there are any weak points in security controls that need to be strengthened\u003C/li\u003E\n\u003Cli\u003EIf users of services are aware of their responsibilities for information security and adequately trained\u003C/li\u003E\n\u003Cli\u003EIf additional investment is required to reduce exposure and if so what are the resource implications?\u003C/li\u003E\n\u003C/ul\u003E","label":"5: Evaluation and response"}]},{"gridType":"RichTextBlock","content":"\u003Cp\u003E\u00A0\u00A0\u003C/p\u003E","gtmId":"","gtmClass":""},{"type":"Promo","cta":"","body":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/lk3lygok/data-breach-notification-form.docx\u0022 target=\u0022_blank\u0022 title=\u0022Data Breach Notification form\u0022\u003EData\u00A0Breach Notification form\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/r4ghmdbe/template-data-breach-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Data Breach Register template\u0022\u003EData Breach Register template\u003C/a\u003E\u003C/li\u003E\n\u003Cli\u003E\u003Ca rel=\u0022noopener\u0022 href=\u0022https://prod-cms.scouts.org.uk/media/r2nhpvr0/template-risk-register.xlsx\u0022 target=\u0022_blank\u0022 title=\u0022Risk Register template\u0022\u003ERisk Register template\u003C/a\u003E\u003C/li\u003E\n\u003C/ul\u003E","link":null,"colour":"#f1f1f1","title":"Useful resources for Step 12","image":null,"imageFocus":"","imageId":0,"imageKey":"00000000-0000-0000-0000-000000000000","imageCrop":"","gridType":"card","gtmId":"","gtmClass":""}]}],"config":null}]},"prev":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},"next":{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"},"allParts":[{"link":"/volunteers/running-things-locally/gdpr-toolkit/introduction/","title":"Introduction"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-1-what-do-i-need-to-know-about-data-protection/","title":"Step 1: What do I need to know about data protection?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-2-who-is-responsible-for-what/","title":"Step 2: Who is responsible for what?"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-3-appointing-a-data-lead/","title":"Step 3: Appointing a Data Lead"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-4-understanding-data-subjects-rights/","title":"Step 4: Understanding data subjects\u0027 rights"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-5-gathering-data/","title":"Step 5: Gathering data"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-6-data-discovery/","title":"Step 6: Data discovery"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-7-keep-a-record/","title":"Step 7: Keep a record"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-8-check-your-security/","title":"Step 8: Check your security"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-9-third-parties/","title":"Step 9: Third parties"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-10-publish-your-privacy-stance/","title":"Step 10: Publish your privacy stance"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-11-delete-and-destroy/","title":"Step 11: Delete and destroy"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","title":"Step 12: Responding to a breach"},{"link":"/volunteers/running-things-locally/gdpr-toolkit/step-13-have-a-complaints-process/","title":"Step 13: Have a Complaints Process"}],"link":"/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/","id":47229,"nodeName":"Step 12: Responding to a breach","title":"Step 12: Responding to a breach","type":"codexPart","image":null,"assets":null,"headerOptions":{"headerTitle":"Step 12: Responding to a breach","headerSubTitle":null,"headerCta":null,"headerCtaText":null,"headerCtaLink":null,"headerBackgroundColour":null,"showSEOImage":false,"headerBackgroundImage":null,"quickLinks":null},"searchDescription":"","subHeader":"","browserTitle":null,"silktide":"eyJjbXMiOiJVbWJyYWNvIiwiZWRpdG9yVXJsIjoiaHR0cHM6Ly9wcm9kLWNtcy5zY291dHMub3JnLnVrLy91bWJyYWNvIy9jb250ZW50L2NvbnRlbnQvZWRpdC80NzIyOSJ9","canonicalUrl":"https://www.scouts.org.uk/volunteers/running-things-locally/gdpr-toolkit/step-12-responding-to-a-breach/"}