**Branston & Mere GDPR Breach Policy**.pdf

A breach of personal data may result in a loss of control of personal data, discrimination, identity theft or fraud, financial loss, damage to reputation, loss of confidentiality of personal data, damage to property or social disadvantage.
If the data breach is likely to result in a risk to the rights and freedoms of the individual, the breach must be reported to the individual and ICO without undue delay and, where feasible, not later than 72 hours after having become aware of the breach.
When notifying the ICO of a breach, Branston & Mere Parish Council must:
i. Describe the nature of the breach including the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned
ii. Communicate the name and contact details of the DPO
iii. Describe the likely consequences of the breach
iv. Describe the measures taken or proposed to be taken to address the personal data breach including, measures to mitigate its possible adverse effects.
When notifying the individual affected by the breach, Branston & Mere Parish Council must provide the individual with (ii)-(iv) above.
Branston & Mere Parish Council would not need to communicate with an individual if the following applies:
 It has implemented appropriate technical and organisational measures (i.e. encryption) so those measures have rendered the personal data unintelligible to any person not authorised to access it;
 It has taken subsequent measures to ensure that the high risk to rights and freedoms of individuals is no longer likely to materialise, or
 It would involve a disproportionate effort
However, the ICO must still be informed even if the above measures are in place.
Data processors duty to inform Branston & Mere Parish Council
If a data processor becomes aware of a personal data breach, it must notify Branston & Mere Parish Council without undue delay.
All data breaches must be recorded whether or not they are reported to individuals.
To report a data breach use the ICO online system: https://ico.org.uk/for-organisations/report-a-breach/