Personal data breach lessons and control review record

Enter the school's internal incident or case reference. Do not include unnecessary personal data.

Describe what happened, the affected systems or records, the categories of personal data involved and the relevant circumstances. Avoid including more personal data than necessary.

Use the earliest date known. If the occurrence date is unknown, enter the date it was first identified and explain the uncertainty in the incident summary.

Enter the date on which this lessons-learned and control review was completed.

Enter the name and role of the person responsible for coordinating this review.

Select the status that applied to this incident. This field records the incident context and does not determine whether notification was legally required.

Record the actions taken to contain the breach, protect affected people and preserve relevant evidence.

Select all categories that were involved or potentially involved.

Describe what the school learned about the incident, its causes, decision-making, communications, response arrangements and prevention of recurrence.

Assess whether the process identified the relevant threat, data, people, systems, dependencies, vulnerabilities and potential consequences before the incident.

Explain any gaps identified, including what was omitted, out of date, insufficiently specific or not reflected in operational practice.

Assess the controls that were intended to prevent, detect, contain or recover from this incident.

For each relevant control, record its intended purpose, how it operated during the incident, evidence reviewed, weaknesses identified and whether it should be retained, changed, replaced or added.

List the records used to support the review, such as policies, risk assessments, access logs, training records, incident records, technical reports, meeting notes or communications. Do not attach unnecessary personal data.

Describe each action needed to address a cause, control weakness or risk-assessment gap. Include the expected outcome and any dependencies.

Select the highest priority assigned to any action in this record.

Name the role or person accountable for completing the corrective actions. Use roles where appropriate and avoid unnecessary personal data.

Enter the target date for completing the corrective actions. If different actions have different dates, record them in the corrective actions field.

Select the current status of the corrective actions at the time this record is completed.

Describe or reference the evidence demonstrating that completed actions were implemented and, where relevant, tested or checked for effectiveness.

Record the risk assessments that need updating, the changes required and the date or review point for making those changes.

Record any controls or procedures to introduce, strengthen, remove or monitor, including how implementation will be verified.

Enter the date for checking that corrective actions and resulting changes remain effective. If no follow-up is required, explain why in the final comments.

Record any remaining uncertainty, dependencies, accepted residual issues or matters requiring escalation.

Select this only after reviewing the completed record for accuracy and completeness.

• Tick when complete