1. Purpose and Scope of the Policy
1.1 Under the General Data Protection Regulations (EU) 2016/679 (GDPR) and the Data Protection Act 2018 (together the data protection legislation) we may be obliged to report certain personal data breaches (as defined below) to the Information Commissioner’s Office (ICO) and to data subjects. This policy governs how we will handle such personal data breaches (policy).
1.2 This policy deals with the roles and responsibilities of Sanderson Weatherall Group Limited (CN 04870380) and any of its subsidiary companies and affiliates which, for the avoidance of doubt, includes Sanderson Weatherall LLP (OC 344770) (Sanderson Weatherall Group), with regard to the processing of personal information and has been prepared to help the Sanderson Weatherall Group comply with its obligations under the data protection legislation.
1.3 This policy applies to all individuals working within any entity within the Sanderson Weatherall Group, including directors, partners, employees, consultants, contractors, casual and agency workers (referred to together in this policy as personnel).
1.4 One of the principles of the data protection legislation provides that appropriate technical and organisational measures are to be taken to ensure that personal information is kept secure and is protected against unauthorised or unlawful processing and against accidental loss, destruction, or damage.
1.5 All those to whom this policy applies are referred to as you and your in this policy and references to we, us or our refers to the entity in the Sanderson Weatherall Group who controls the way the personal information is used.
1.6 Each Sanderson Weatherall Group company is responsible for ensuring that it complies with the data protection legislation. Protecting the confidentiality and integrity of personal information is a responsibility that we take seriously at all times.
1.7 This policy does not form part of any employee’s contract of employment and it may be amended at any time.
1.8 It is important that you take responsibility for ensuring that you act in accordance with this policy. Any breach of this policy by you will be taken seriously and may result in disciplinary action. It may also result in us breaching the data protection legislation or other legal requirements.
1.9 Any questions about the operation of this policy or any concerns that the policy has not been followed should be referred in the first instance to the Sanderson Weatherall Group Data Protection Manager whose contact details are provided in the Questions section of this policy.
2. Definitions
2.1 In this policy the following words have the meanings set out below:
2.1.1 a controller means the person or organisation that determines when, why and how to process personal information. It is responsible for establishing practices and policies in line with the data protection legislation. For example, each Sanderson Weatherall Group affiliate will likely be the data controller of the personal information about its employees;
2.1.2 a processor means an organisation that processes personal information on behalf of a data controller in accordance with the data controller’s instructions. Sanderson Weatherall Group may also use a data processor to process personal information on its behalf, for example if Sanderson Weatherall Group’s payroll is carried out by a third party, the provider would be likely to be the relevant group entity’s data;
2.1.3 a data subject means an individual about whom we hold personal information, for example an employee, a partner of Sanderson Weatherall LLP, a worker, a contractor, an apprentice, an intern, a job applicant, a customer, individuals employed by customers and suppliers, and professional advisers such as legal advisers;
2.1.4 personal information means information that is about a data subject and which identifies the data subject.
2.1.5 process(ing) means any operation or set of operations which is performed on personal information or on sets of personal information, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
2.1.6 relevant group entity means the member of the Sanderson Weatherall Group that is the controller of the personal information; and
2.1.7 special category personal data means personal information revealing racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health conditions, sexual life, sexual orientation, biometric or genetic data, and personal information relating to criminal offences and convictions.
3. What is a Personal Data Breach?
3.1 A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal information transmitted, stored or otherwise processed.
3.2 Examples of personal data breaches may be:
3.2.1 a relevant group entity employee leaving personal information about its employees or any of its tenants (such as their names and contact details) on a train;
3.2.2 IT systems or back-up files being subject to a hack which allows access to personal information on the system;
3.2.3 sending an e-mail containing personal information (for example, employee remuneration details, or a tenant’s details) to a third party that is not entitled to see it;
3.2.4 the loss of a folder of papers or an electronic device such as a memory stick containing personal information in a public place; and
3.2.5 the theft of a laptop or mobile device of an employee of the relevant group entity containing personal information, such as a database, documents or e-mails.
4. What Should I do if I Think a Personal Data Breach has Occured?
4.1 If you know or suspect that a personal data breach may have occurred, regardless of who is at fault or the size of the breach, this should be reported to the nominated individual (see below) immediately by telephone on 0113 221 6000 in the first instance and by email at martin.archer@sw.co.uk. Failure to do so may severely impact on our ability to limit damage to, and to protect or recover, personal information. In the event of a personal data breach, you should be prepared to provide as much of the information set out below in section 5 as soon as possible.
4.2 The nominated individual is Martin Archer, who can be contacted via e-mail at martin.archer@sw.co.uk and by phone on 0113 221 6001. In Martin’s absence, the breach should be reported to Paul Crawshaw who will act as the nominated individual if Martin Archer is not around, Paul can be contacted by email at paul.crawshaw@sw.co.uk and by phone on 0113 221 6003.
4.3 If you have been notified of a personal data breach, or a suspected personal data breach, by a third party employed or contracted by us, then you should still notify the nominated individual immediately.
4.4 You should also notify the nominated individual if there is a ‘near-miss’ (in other words, if something occurs which nearly leads to a personal data breach).
5. What Information Should I Provide on the Personal Data Breach?
5.1 In order to ensure that we can deal with the personal data breach or suspected personal data breach in the appropriate manner, it is essential that accurate and complete information is provided to the nominated individual.
5.2 The nominated individual should be provided with as much detail as possible including:
5.2.1 when the breach occurred and when you first became aware of it or it was discovered. This will be particularly relevant if the breach involves some sort of illegal activity;
5.2.2 how the personal information was stored including any relevant security measures relating to the method of storage (i.e. paper records in a locked file or electronic records on a laptop);
5.2.3 who was responsible for the personal information at the time of the breach;
5.2.4 how the breach occurred (i.e. was the personal information misplaced or stolen etc.);
5.2.5 if the personal information was stored on a USB stick, laptop, smart phone or other mobile device, details of any protection on the device, such as encryption, should also be noted;
5.2.6 any steps that you have taken to try to mitigate the effect of the personal data breach; and
5.2.7 the nature of the personal data breach, which will include the:
(a) categories of data subjects affected by the breach;
(b) approximate number of data subjects concerned;
(c) categories of personal information concerned (for example, names, addresses, employment history, bank account details, medical reports etc.); and
(d) approximate number of personal information records concerned.
5.3 You should not wait to notify the nominated individual of the suspected or actual personal data breach if all of the information above is not readily available. Please still notify the nominated individual immediately and include all the information you have at that point. If, once you have notified the nominated individual, you become aware of further information in relation to the personal data breach, this should be provided immediately.
6. Containment and Recovery
6.1 On receiving notification of a suspected or actual personal data breach;
6.1.1 the nominated individual will notify and liaise with the Executive Board. Details of the members of the Executive Board are available on the Intranet at ‘MySW’;
6.1.2 the nominated individual, or any other member of the Executive Board as agreed between them, will liaise with the Sanderson Weatherall Group’s IT department, and the Sanderson Weatherall Group cloud storage provider, or any other internal agencies as appropriate in order to determine the appropriate course of action for containment and recovery.
6.2 Steps should be taken to identify the cause of the personal data breach and whether this has been contained.
6.3 Any possibility of a further loss of personal information should be mitigated by:
6.3.1 identifying steps that can, or need to, be taken to contain the personal data breach from further loss or to recover any personal information;
6.3.2 taking those steps; and
6.3.3 contacting necessary professionals that can assist with this process.
6.4 All actions should be logged in the data security incidents log held by the nominated individual. Where a processor such as a third party provider of an outsourced IT system) has suffered a personal data breach which affects the personal information it processes for the relevant group entity, the processor has an obligation to notify the relevant group entity without undue delay after becoming aware of a personal data breach.
6.5 In such circumstances, the nominated individual will work alongside the internal team of the processor to obtain the necessary information to be collected and logged. The nominated individual (or persons appointed by them) shall be responsible for documenting the same (please see section 9 for more details).
7. Assessment of Ongoing Risks
7.1 We will assess the risk associated with the personal data breach in order to determine the necessary steps for further containment and response.
7.2 An assessment of the ongoing risk will involve considering the following:
7.2.1 type of breach. The breach may affect the risk to data subjects, for example, a confidentiality breach whereby information has been disclosed to unauthorised parties may have a different set of consequences for an individual to a personal data breach where an individual’s details have been lost, and are no longer available;
7.2.2 nature, sensitivity and volume of the personal information involved. Usually, the more sensitive the data, the higher the risk of harm will be to the data subjects affected, but consideration should also be given to other personal information that may already be available about the data subject. personal data breaches involving specific types of personal information (identity documents or financial data), can all cause harm on their own, but if used together they could be used for identity theft (a combination of personal information can be more sensitive than a single piece of personal information). A small amount of highly sensitive personal information can have a high impact on a data subject, and a large range of personal information can reveal a greater range of information about that data subject. Also, a personal data breach affecting large volumes of personal information can have an effect on a correspondingly large number of data subjects;
7.2.3 ease of identification of data subjects. How easy will it be for a party who has access to compromised personal information to identify specific data subjects, or match the data with other information to identify data subjects? For example the risk of an individual being identified would be lower if the personal information was protected by an appropriate level of encryption which would be unintelligible to unauthorised persons without the decryption key;
7.2.4 severity of consequences for data subjects. For example, where a personal data breach involves special category personal information the potential damage to data subjects that could result can be especially severe, in particular where the personal data breach could result in identity theft or fraud, physical harm, psychological distress, humiliation or damage to reputation. If the personal data breach concerns personal information about vulnerable data subjects, they could be placed at greater risk of harm;
7.2.5 special characteristics of the individual. A personal data breach may affect personal information concerning children or other vulnerable data subjects, who may be placed at greater risk of danger as a result; and
7.2.6 the number of data subjects affected. Generally, the higher the number of data subjects affected, the greater the impact a personal data breach can have. However, a personal data breach can have a severe impact on even one individual, depending on the nature and context of the personal information that has been compromised.
7.3 This assessment will be used to inform any decision on whether the personal data breach needs to be notified under the data protection legislation to either the ICO or the data subjects concerned.
8. Notifying the Breach
8.1 If the breach has arisen as a result of illegal behaviour such as theft or hacking, this should be notified to the police or other relevant law enforcement agencies. Action Fraud is the UK’s national fraud and cybercrime reporting centre. Further details can be found at www.actionfraud.police.uk.
Notifying the ICO
8.2 As mentioned above, the nominated individual shall without undue delay, and where feasible, not later than 72 hours after having become aware, notify the ICO of the personal data breach if the personal data breach is one which is likely to result in a risk to the rights and freedoms of data subjects.
8.3 The time period for notifying the breach starts when we become ‘aware’ of the breach. In this context, ‘aware’ means that there is a reasonable degree of certainty that a personal data breach has occurred that has led to personal information being compromised. This means that in accordance with the data protection legislation, we are under an obligation at all times to implement all appropriate technical protection and organisational measures to establish immediately whether a personal data breach has taken place.
8.4 Depending on the circumstances, a personal data breach may or may not require notification to ICO. For example, if our IT systems are unavailable for several hours (e.g. due to a power loss) this is unlikely to present a risk to individual’s rights and freedoms and therefore would not require notification. However, if there is a ransomware attack on our systems (ransomware is malicious software which encrypts the data until a ransom is paid) which leads to a temporary loss of access to personal information until it can be restored from a backup, the instigator of the attack will have gained access to our corporate infrastructure and therefore a notification to the ICO in these circumstances would likely be required.
8.5 In making any such decision to notify the ICO, the nominated individual and the Executive Board shall consider the consequences of notification and non-notification and take into account the ICO’s guidance on breach notification (www.ico.org.uk) and the European Data Protection Board’s guidelines for personal data breach notification (www.ec.europa.eu). If there is any uncertainty as to whether it is appropriate to notify the ICO, we will consider obtaining legal advice on this point as soon as possible.
8.6 The nominated individual shall not notify the ICO until the Executive Board have been consulted in accordance with the provisions of this policy.
8.7 Where a notification to the ICO in accordance with section 8.2 is required, the notification should describe the information set out in Annex 1. If we are unable to provide all of the information required within the time limits set out in section 8.3, we are permitted to provide as much information as possible within those time limits, and shall provide all further information which may arise as soon as possible after that deadline (phased notification).
8.8 Where a notification to the ICO in accordance with section 8.2 is required and the relevant group entity fails to make the notification with 72 hours, we would need to notify the ICO as soon as possible thereafter and include in the notification the reasons for the delay.
Notifying data subjects
8.9 The Executive Board and the nominated individual shall consider whether any data subjects affected by the personal data breach need to be notified. Notification to the data subjects is required where the personal data breach is likely to result in a high risk to the rights and freedoms of data subjects (high risk breach). Where applicable, communication in these circumstances should be made to the data subjects without undue delay (i.e. as soon as possible). This is because the main objective of notifying data subjects is to provide specific information about the steps that they need to take as a result of the personal data breach to minimise the effect of the breach.
8.10 In circumstances where a decision is required as to whether to notify data subjects about a personal data breach (because it is not immediately apparent that the personal data breach is a high risk breach), we will look at and consider whether the personal information concerned was protected with appropriate technical and organisational measures.
8.11 If appropriate protection is in place and there is a personal data breach it is unlikely that the data subjects should be notified. However, each situation will depend on the circumstances and in each case where there is a potential high risk breach, we may seek guidance from the ICO or our legal advisors.
Communicating the breach to data subjects
8.12 If it is decided that data subjects should be notified of the personal data breach then notification should be carried out without undue delay and contain the information set out in Annex 2.
8.13 Affected data subjects should be contacted directly unless doing so would involve a disproportionate effort (if it is disproportionate, then a public communication or other similar measure to inform data subjects should be used). This will be considered at the time of the personal data breach by the Executive Board and the nominated individual.
8.14 We will use dedicated messages to communicate with affected data subjects which deal specifically with the details of the personal data breach. These messages may be sent by email, SMS or a direct message, postal communication or by way of an advertisement in print media. This medium of communication will be considered at the relevant time based on an assessment of the situation.
8.15 In some personal data breach situations, the Executive Board and the nominated individual may need to consider and take into account the legitimate interests of law enforcement authorities where early disclosure of the personal data breach could hamper the investigation of a personal data breach. In these circumstances, where justified, this may mean that the relevant group entity will delay communicating the personal data breach to the affected data subjects until such time as this notification will no longer prejudice the law enforcement investigations. This will be recorded in the documentation which we are required to maintain in respect of a personal data breach. Further information on the documentation required is set out in section 9.
Notifying others
8.16 The Executive Board should also consider if it:
8.16.1 has any contractual duties to notify other third parties;
8.16.2 should notify any financial institutions;
8.16.3 should notify its insurers; and
8.16.4 should notify other regulatory authorities/professional bodies.
8.17 The Executive Board should also consider whether the scale of the personal data breach will likely attract media interest. If so, they should consider a media strategy (including the production of a media statement). If the Executive Board believes that a media strategy needs to be considered in relation to a personal data breach, they will liaise with the company’s internal and external PR advisors.
9. Documentation
9.1 Under the data protection legislation we are required to keep a record of all personal data breaches. In relation to each personal data breach, this record must include the following information:
9.1.1 all the facts relating to the personal data breach including what happened, what caused the personal data breach and the personal information affected. It should also include all notes and times of discussions with the ICO and if relevant, details of any phased notification to the ICO;
9.1.2 where relevant, details of where there has been a delay in notifying the ICO and why;
9.1.3 the effects and consequences of the personal data breach on affected data subjects; and
9.1.4 the remedial action that was taken by the relevant group entity.
9.2 personal data breaches that are reported to the nominated individual and which turn out to be ‘near misses’ (as referred to in section 4.4) will also be recorded in detail in these records.
9.3 The records will be required as evidence of our compliance with the data protection legislation.
10. Reviewing the Response
10.1 Once the personal data breach has been dealt with, a team of data subjects including the nominated individual will be appointed to review and evaluate the response and how it was dealt with. Consideration will be given to:
10.1.1 the speed of the response;
10.1.2 the adequacy of the response;
10.1.3 whether any further training is required for our personnel;
10.1.4 whether any procedures or processes need to be amended; and
10.1.5 whether any of the Sanderson Weatherall Group’s current policies or procedures should be amended in light of the breach.
10.2 Consideration of the issues at section 10.1 shall form part of a wider data protection impact assessment.
10.3 If applicable, the results of any review shall be communicated to directors, employees and other data subjects acting on behalf of the Sanderson Weatherall Group and this policy shall be updated to reflect any recommendations from that review.
11. Questions
If you have any questions regarding a request by a data subject to exercise their rights under the data protection legislation, please contact the Sanderson Weatherall Group Data Protection Manager whose details are set out in the table below.
Data Protection Manager Telephone Number E-mail Office Address
Martin Archer 0113 221 6001 martin.archer@sw.co.uk 6th Floor Central Square, 29 Wellington Street, Leeds, LS1 4DL
12. Policy Review
This policy will be reviewed by the Data Protection Manager on an annual basis to ensure it remains compliant with guidance and best practice.
13. References / Related Documents
13.1 Sanderson Weatherall Group Customer Privacy Policy;
13.2 Sanderson Weatherall Group Data Subject Rights Policy; and
13.3 Sanderson Weatherall Group Data Protection Policy.
Annex 1
(Details to be included in notification to the ICO)
1. The nature of the personal data breach, including:
a. categories of data subjects affected by the breach;
b. approximate number of data subjects concerned;
c. categories of personal information records concerned; and
d. approximate number of personal information records concerned.
2. The name and contact details of the nominated individual or other contact point.
3. The likely effect and consequences of the personal data breach.
4. The measures taken or proposed to be taken to address the personal data breach, including measures to mitigate any possible adverse effects.
5. The reason for delay if the notification is not within 72 hours.
Annex 2
(Details to be included in notification to data subjects)
1. A description of the personal data breach.
2. The name and contact details of the nominated individual or other contact point.
3. The likely effect and consequences of the personal data breach.
4. The measures taken or proposed to be taken by the relevant group entity to address the breach, including where appropriate, measures to mitigate its possible adverse effects.
5. Where applicable, provide specific advice and/or recommendations for the data subject to mitigate adverse effects (for example, notifying the individual that his/her bank details have been lost or stolen and to notify their bank and change passwords).