1. Introduction

Workers Direct is committed to protecting the security of all personal and sensitive data we process. This policy outlines our approach to data breach management and the procedures to follow in the event of a breach.

2. Scope

This policy applies to all staff, contractors, and third-party suppliers who process data on behalf of Workers Direct.

3. Definition of a Data Breach

A data breach is defined as any event that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or processed by Workers Direct.

4. Responsibilities

• 4.1 All staff are responsible for reporting suspected data breaches immediately.
• 4.2 The Data Protection Officer (DPO) is responsible for investigating and managing the response to data breaches.
• 4.3 Senior management is responsible for reporting breaches to relevant authorities when required.

5. Breach Reporting Procedure

1. 5.1 Any staff member who discovers or suspects a data breach must report it immediately to their line manager and the DPO.
2. 5.2 The initial report should include:
   • Date and time of discovery
   • Description of the breach
   • Categories of data affected
   • Initial assessment of risk

6. Breach Management Procedure

1. 6.1 Containment and Recovery: The DPO will coordinate immediate steps to contain the breach and recover any data possible.
2. 6.2 Risk Assessment: The DPO will assess the risks associated with the breach including potential harm to affected individuals.
3. 6.3 Notification: Where required, the DPO will notify:
   • a) The Information Commissioner's Office (ICO) within 72 hours of becoming aware of a breach that poses a risk to individuals' rights and freedoms
   • b) Affected individuals without undue delay when the breach is likely to result in a high risk to their rights and freedoms
   • c) Relevant third parties as appropriate

7. Record Keeping

The DPO will maintain a breach register documenting all breaches, actions taken, and preventative measures implemented.

8. Training and Awareness

All staff will receive training on data protection and breach reporting as part of their induction and ongoing professional development.

9. Policy Review

This policy will be reviewed annually or following any significant change in our data processing activities or relevant legislation.