Information Incident Reporting

The Data Security and Protection Toolkit includes a tool for reporting data security incidents to the Information Commissioner’s Office, the Department of Health and Social Care and NHS England. Organisations must notify a breach of personal data within 72 hours from it being discovered. A guide to reporting such incidents is here. When you input a data incident the system will ask the following series of questions in order to grade the incident.

The incident must also be reported to the Data Protection Officer.