Personal data breach report and notification record

Use the school's internal reference for this incident.

Enter the name of the school managing this record.

Name the person responsible for maintaining this record and their school role.

Select all categories that describe the event.

Give an accurate factual account. Record what is known and identify any material uncertainty.

If the date is unknown, record the earliest known date in the incident summary and leave this field blank if permitted by local record-keeping practice.

Record the date the school found out about the incident.

Describe how the incident was identified, including the source of the alert or report.

Select this if the facts, scope or effects are not yet fully established.

• Tick when complete

Record significant events, decisions and actions in date-and-time order. Add later entries as the investigation develops.

Select all that apply and use the other option for categories not listed.

Select all that apply.

Enter the current estimate. If unknown, record that in the affected-people narrative and update this field when possible.

Explain how the categories and estimate were determined, including any vulnerable groups or particularly sensitive circumstances relevant to the assessment.

Identify the systems, records, devices, locations or unintended recipients involved, where known.

Record actions taken to contain the incident, with dates, times, owners and any remaining limitations.

Record steps taken or planned to reduce harm and prevent recurrence.

Describe the potential consequences and likelihood as assessed by the school, including any reasons for the assessment.

Record the school's decision and rationale. Complete this even if the decision is not to report.

Explain the assessment, including any uncertainty, the information available at the time and why the selected decision was reached.

Complete if the school has reported the incident to the ICO.

Complete if provided by the ICO.

Complete if reported. Record what was submitted, who submitted it, relevant contact details, and any information to be provided later without undue delay.

Select only organisations relevant to the circumstances. Notification is not assumed for every incident. If the event involved a cyber incident, consider the NCSC; if criminal intent is suspected, consider Report Fraud; also consider the insurer and law enforcement where relevant.

For each relevant organisation, record whether it was notified, the decision not to notify, the date, reference number, contact and rationale. Complete only where relevant.

Record whether affected people were or will be contacted, the decision and rationale, the audience, date, method and message. Complete only where relevant.

Record the names, roles and contact details of people who can provide further information, such as the incident lead, data protection officer, designated safeguarding lead or IT lead where relevant.

Record relevant contacts at notified organisations, suppliers, insurers, law enforcement or other parties.

Record acknowledgements, confirmations or reference numbers received from the ICO or other notified organisations. Complete only where applicable.

Set a date to review unresolved facts, containment, notifications and any additional information that needs to be supplied.

Add dated updates without undue delay, including new facts, revised estimates, additional reports or notifications, further mitigation and changes to contacts.

Complete when the school has completed its internal review and no further update is expected, subject to the school's retention arrangements.

Summarise the final known position, outstanding actions, lessons identified and owner or due date for any continuing actions.