Policies & Procedures

Data Breach & Information Security Incident Procedure v2.0

Policy Lead Mrs. Tavleen Sharma - Registered Manager

Version No. 2.0

Date of issue May 2026

Date to be reviewed April 2027

Purpose

VCare Consultancy Services Limited is committed to protecting confidential, personal and sensitive information and ensuring that any actual or suspected data breach or information security incident is identified, managed, investigated and reported appropriately.

This procedure sets out the actions required to:

• identify and respond to data breaches;
• minimise harm to individuals and the organisation;
• comply with UK GDPR and Data Protection Act 2018;
• support safeguarding obligations;
• meet CQC and NHS DSP Toolkit requirements;
• maintain operational resilience and governance.

Scope

This procedure applies to:

• all employees;
• directors;
• agency workers;
• contractors;
• volunteers;
• third parties handling organisational information.

It applies to:

• electronic records;
• paper records;
• verbal disclosures;
• emails;
• care systems;
• mobile devices;
• cloud systems;
• removable media.

Definition of a Data Breach

A personal data breach means a breach of security leading to the accidental or unlawful:

• destruction;
• loss;
• alteration;
• unauthorised disclosure of;
• unauthorised access to;
  personal data.

Examples include:

• sending information to the wrong person;
• lost or stolen devices;
• unauthorised access to care records;
• cyber attack or ransomware;
• phishing incidents;
• insecure disposal of records;
• discussing confidential information inappropriately;
• system compromise;
• accidental deletion of records.

Immediate Actions Following a Suspected Breach

Any person identifying or suspecting a breach must immediately:

1. Report the incident to management without delay.
2. Take reasonable steps to contain the breach where safe to do so.
3. Preserve evidence relating to the incident.
4. Avoid deleting or altering potentially relevant information.
5. Record all known details.

Staff must not attempt to conceal breaches or delay reporting.

Reporting Process

All breaches or suspected breaches must be reported immediately to:

• the Registered Manager; and/or
• senior management.

The following information should be recorded:

• date and time of incident;
• nature of the breach;
• individuals affected;
• type of information involved;
• how the breach occurred;
• immediate containment actions taken;
• systems or records affected;
• any safeguarding concerns identified.

Containment and Recovery

Management will assess immediate containment measures which may include:

• restricting system access;
• password resets;
• isolating affected devices;
• contacting unintended recipients;
• recovering records;
• suspending compromised accounts;
• involving IT support providers;
• implementing business continuity arrangements.

The organisation will act promptly to minimise ongoing risks.

Risk Assessment

A formal risk assessment will be undertaken to determine:

• the sensitivity of the information involved;
• the volume of information affected;
• likelihood of harm;
• risk to confidentiality;
• safeguarding implications;
• risk of identity theft or fraud;
• risk to service users, staff or others;
• operational impact.

Particular consideration will be given where breaches involve:

• health information;
• safeguarding information;
• vulnerable adults;
• children;
• mental health records;
• financial information.

Notification Requirements

Information Commissioner’s Office (ICO)

Where a breach is likely to result in a risk to individuals’ rights and freedoms, the ICO will be notified without undue delay and, where feasible, within 72 hours of awareness.

Affected Individuals

Individuals affected by a breach may be informed where there is a high risk to their rights or freedoms.

Notifications may include:

• nature of the breach;
• likely consequences;
• actions taken;
• advice on protective measures;
• contact details for further information.

Other Notifications

Where appropriate, breaches may also be reported to:

• local authorities;
• safeguarding teams;
• commissioners;
• NHS organisations;
• CQC;
• police or cyber security authorities.

9. Investigation

All significant incidents will be investigated to identify:

• root causes;
• procedural failures;
• system weaknesses;
• human factors;
• training needs;
• required corrective actions.

Investigations may include:

• audit of records;
• review of system access;
• staff interviews;
• review of policies and procedures.

10. Corrective and Preventative Actions

Following investigation, VCare Consultancy Services Limited will implement appropriate actions which may include:

• additional staff training;
• policy review;
• disciplinary action where appropriate;
• improved access controls;
• system updates;
• cyber security improvements;
• revised working practices;
• enhanced monitoring.

11. Record Keeping

A record of all reported breaches and security incidents will be maintained including:

• incident details;
• risk assessments;
• investigation findings;
• actions taken;
• notifications made;
• lessons learned.

Records will be retained securely.

12. Staff Responsibilities

All staff must:

• maintain confidentiality;
• follow organisational policies;
• use systems securely;
• complete mandatory training;
• report incidents immediately;
• cooperate with investigations.

Failure to comply may result in disciplinary action.

Training and Awareness

VCare Consultancy Services Limited provides staff training relating to:

• GDPR and confidentiality;
• cyber security awareness;
• phishing awareness;
• secure handling of records;
• incident reporting responsibilities.

Training compliance is monitored through governance arrangements.

Related Policies

This procedure should be read alongside:

• Information Security Policy;
• Confidentiality Policy;
• GDPR/Data Protection Policy;
• Business Continuity Policy;
• Safeguarding Policies;
• Incident Reporting Policy;
• Disciplinary Policy.

Monitoring and Review

This procedure will be reviewed:

• annually;
• following significant incidents;
• following legislative or operational changes.