Data Breach Management
Data Breach Management Policy and Register
Hannington Parish Council takes its responsibilities under the Data Protection Act 2018 and UK GDPR seriously. This includes having clear procedures in place to identify, respond to and record any actual or suspected personal data breach promptly and appropriately.
A personal data breach occurs when personal information held by the council is accidentally or unlawfully lost, destroyed, altered, disclosed or accessed without authorisation. This can happen in a variety of ways — for example, an email sent to the wrong recipient, a lost device containing council data, or unauthorised access to a council system.
Our Data Breach Management Policy sets out:
- The steps the council takes to prevent breaches from occurring in the first place
- How breaches should be identified and reported
- The council's step-by-step response procedure, including when and how we are required to notify the Information Commissioner's Office (ICO) within the legally required 72-hour window
- How affected individuals will be informed where required
- How the council will review its procedures following any breach to prevent recurrence
In accordance with UK GDPR, the council also maintains a Data Breach Register — a confidential internal record of all breaches, whether or not they are required to be reported to the ICO. As at May 2026, Hannington Parish Council has no recorded data breaches.
These documents are reviewed annually by the Council and are next due to be reviewed at the Quarterly Meeting of the Parish Council on 6th May 2026.
If you wish to report a suspected data breach involving Hannington Parish Council, please contact the Clerk at [email protected]