received by an employee or volunteer, please refer the requestor to the Students’ Union’s Data Protection Officer. Information security breaches A personal data breach means a breach of security leading to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This means that a breach is more than just losing personal data. A data security breach can happen for a number of reasons: Loss or theft of data or equipment Inappropriate access controls allowing unauthorised use Equipment failure Human error Unforeseen circumstances such as fire or flood Hacking attack Deception of the organisation through offences ‘blagging’ Detecting data breaches Detecting a data breach or the potential of a data breach can happen in a variety of ways. The table below identifies some of the methods of detection and processes for handling such detections. Detection Action for Action for Method potential actual breach breach Employee/ If you think you Immediately Volunteer have identified report the Detection a potential for matter to data security to the Data be breached Protection you must Officer, immediately permanent inform your line staff contact manager (or (if staff contact if volunteer) you are a or line volunteer) and manager - the Data isolating Protection any Officer. They potential for may further immediately breach cease where processing this appropriate. data until the The DPO potential for and other breach is involved resolved based parties upon an should assessment of follow the the risk to CIRP individuals detailed privacy. below. Accidental If there is a Immediately Breach (such high likelihood report the
received by an employee or volunteer, please refer the requestor to the Students’ Union’s Data Protection Officer. Information security breaches A personal data breach means a breach of security leading to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This means that a breach is more than just losing personal data. A data security breach can happen for a number of reasons: Loss or theft of data or equipment Inappropriate access controls allowing unauthorised use Equipment failure Human error Unforeseen circumstances such as fire or flood Hacking attack Deception of the organisation through ‘blagging’ offences Detecting data breaches Detecting a data breach or the potential of a data breach can happen in a variety of ways. The table below identifies some of the methods of detection and processes for handling such detections. Detection Method Action for potential breach Action for actual breach Employee/ Volunteer Detection If you think you have identified a potential for data security to be breached you must immediately inform your line manager (or staff contact if you are a volunteer) and the Data Protection Officer. They may immediately cease processing this data until the potential for breach is resolved based upon an assessment of the risk to individuals privacy. Immediately report the matter to the Data Protection Officer, permanent staff contact (if volunteer) or line manager - isolating any potential for further breach where appropriate. The DPO and other involved parties should follow the CIRP detailed below. Accidental Breach (such If there is a high likelihood Immediately report the
WSU-Data-Protection-Handbook-for-staff-and-volunteers_28082018.docx