the extent of the breach, i.e. how many individuals are affected the harms to affected individuals that could potentially be caused by the breach how the breach can be contained The Executive Committee will determine the severity of the incident using the reference table on the next page and by completing the Data Breach Severity Form below (i.e. to decide if the incident can be managed and controlled locally or if it is necessary to escalate the incident to the (ICO). The severity of the incident will be categorised on a scale of 0 to 6. Rating 0 1 2 3 4 5 6 No significant Damage Damage to Damage to Damage to Damage Monetary reflection on to an a Scout the The Scout to The penalty Charity’s any individual Group, reputation. Scout Imposed or body District, Low key by ICO. Media reputation. local or reputation. interest very Possible national Local media National unlikely. media reputation. media coverage. media interest Some local coverage. (e.g. or national prominent subject member of specific the media Charity interest that involved). may not go public. Clients Minor breach Potentially Serious Serious Serious Serious of serious potential breach of breach with breach to affected breach. breach and either a with injured . Less than risk e.g. up to particular potential parties. Only a single five assessed 100 sensitivity for ID Other individual individuals high (e.g. individuals (e.g. sexual theft or Liabilities. affected. affected, affected or mental over Additional or risk and/or health 1000 security. assessed identifiable details, or Legal as low records or up to 1000 costs. (e.g. files lost) Up to particularly individuals affected. were 20 sensitive ie affected.
the extent of the breach, i.e. how many individuals are affected the harms to affected individuals that could potentially be caused by the breach how the breach can be contained The Executive Committee will determine the severity of the incident using the reference table on the next page and by completing the Data Breach Severity Form below (i.e. to decide if the incident can be managed and controlled locally or if it is necessary to escalate the incident to the (ICO). The severity of the incident will be categorised on a scale of 0 to 6. Rating 0 1 2 3 4 5 6 No significant reflection on any individual or body Media interest very unlikely. Damage to an reputation. Possible media interest (e.g. prominent member of the Charity involved). Damage to a Scout Group, District, reputation. Some local or national subject specific media interest that may not go public. Damage to the Charity’s reputation. Low key local or national media coverage. Damage to The Scout reputation. Local media coverage. Damage to The Scout National media Monetary penalty Imposed by ICO. Clients affected Minor breach of Only a single individual affected. Potentially serious breach. Less than five individuals affected, or risk assessed as low (e.g. files were Serious potential breach and risk assessed high (e.g. records lost) Up to 20 Serious breach of e.g. up to 100 individuals affected and/or identifiable or particularly sensitive ie Serious breach with either a particular sensitivity (e.g. sexual or mental health details, or up to 1000 individuals affected. Serious breach with potential for ID theft or over 1000 affected. to injured parties. Other Liabilities. Additional security. Legal costs. .
GDPR-Data-Breach-Response-Plan.docx