This helpsheet has been issued by ICAEW’s Technical Advisory Service to help ICAEW members understand the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 in relation to a data breach. Detailed guidance is available from the Information Commissioner’s Office (ICO).

Members may also wish to refer to the following related helpsheets and guidance:

• Know-how: Personal data breaches
• UK GDPR – Data mapping and documentation
• UK GDPR – Client files
• UK GDPR – Communicating safely with clients

The UK GDPR defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

The ICO suggests there will be a personal data breach whenever any personal data is lost, destroyed, corrupted or disclosed; if someone accesses the data or passes it on without proper authorisation; or if the data is made unavailable, for example, when it has been encrypted by ransomware, or accidentally lost or destroyed.

What is personal data?

The UK GDPR defines Personal data as any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

ICO guidance states that personal data which has been pseudonymised (e.g. the replacement of employee names with employee numbers in a set of data) can help reduce privacy risks by making it more difficult to identify individuals, but is still personal data. Where personal data has been truly anonymised, then the anonymised data is not subject to the UK GDPR as it is no longer personal data.

Examples of personal data breaches

Personal data breaches can be very wide ranging and may include the following examples:

• Unauthorised access to file storage (whether electronic or hardcopy)
• Leaving documents containing personal data on a photocopier/printer in a public area
• Emailing personal data to the wrong recipient
• Accidently deleting or shredding a document or file containing personal data
• Loss of availability of personal data (e.g. server fault)
• Laptops/phones/tablets containing or having access to personal data being lost or stolen
• Cars containing client files being broken into and the files being stolen or there is evidence that they have been read unlawfully
• Passing a client’s contact details onto a third party without a lawful basis to do so
• A staff member downloading a list of client contact details prior to leaving the firm
• A staff member incorrectly updating contact details for the wrong person

Whilst the above are examples of personal data breaches, not all of them would require notification to the ICO and/or the data subject. Further guidance is available in the section Notifications in the event of a personal data breach.

Examples which are not personal data breaches

Whilst the following examples are breaches of the UK GDPR, and a firm should deal with them appropriately, they are not personal data breaches because they do not meet the above definition:

• Failure to respond to a subject access request on time
• Sending marketing information to individuals without their consent
• Loss of data about a deceased individual (as the UK GDPR only applies to living people)

The following section addresses whether personal data breaches are notifiable breaches.

In the event of a personal data breach, a firm must establish the likelihood and severity of the resulting risk to the rights and freedoms of data subjects as this will determine the appropriate notifications. Regard should be given to the ICO’s guidance on personal data breaches, reporting a breach and the European Data Protection Board’s (EDPB) Guidelines on Personal data breach notification.

Please note: The EDPB includes representatives from the data protection authorities of each EU member state. It adopts guidelines for complying with the requirements of the GDPR. Although the UK has left the EU, these guidelines continue to be relevant.

In assessing the risk, a firm should have regard to:

• The type of breach
• The nature, severity and volume of personal data
• Whether the breach involves any special category data
• The ease of identification of individuals
• Severity of consequences for individuals
• Specialist characteristics of the individual or the data controller
• The number of affected individuals

Notifying the ICO

A firm does not need to notify the ICO of every personal data breach. Broadly, a firm should establish the likelihood and severity of the resulting risk to people’s rights and freedoms. If it’s likely that there will be a risk then the ICO must be notified within 72 hours of becoming aware of the breach. If it’s unlikely and the breach is therefore not notified to the ICO, this must still be documented and justified.

It is important to note that failing to notify a breach when required to do so can result in a significant fine. Firms should therefore develop robust policies and procedures for the identification and notification of personal data breaches and ensure they have good documentary evidence to justify any decision not to notify the ICO.

When a notification is required, it is advisable for the firm to have a clear picture of the issue as soon as possible, however it is acceptable to provide additional information to the ICO later if necessary.

Appendix 1 contains examples of personal data breaches and guidance on whether the ICO needs to be notified.

Notifying the data subject

If a breach is likely to result in a high risk to the rights and freedoms of individuals, those concerned must be informed directly and without undue delay (i.e. as soon as possible). One of the main reasons for the requirement to notify data subjects is to help them take steps to protect themselves from the effects of a breach.

In some cases a breach may require notification to the ICO, but the data subject may not need to be notified, because the risk to the rights and freedoms of the data subject is not deemed to be a ‘high risk’. Again this decision should be documented and justified.

When notifying a data subject about a breach a firm would need to describe in plain and clear language the nature of the personal data breach, a name and contact point for where more information can be obtained, a description of the likely consequences of the breach and a description of measures taken or proposed to be taken to deal with the breach and any possible adverse effects.

Appendix 1 contains examples of personal data breaches and guidance on whether to notify the data subject(s).

Notifying ICAEW

The ICO is the relevant supervisory authority with respect to the UK GDPR, not the ICAEW.

There is no automatic obligation to inform ICAEW of all personal data breaches. If, as a result of a breach, a member and/or firm has become liable to disciplinary action, members may need to report through to ICAEW under their duty to report misconduct. Such circumstances are expected to be extremely rare and the ICAEW would not usually need to be notified of personal data breaches.

Robust policies and procedures ensuring compliance with the UK GDPR will assist in reducing the risk of personal data breaches. Given the short notification time limits, firms need to be prepared to respond to breaches should they occur rather than developing such policies after a breach. Firms should therefore consider the following:

• Do staff know how to recognise a personal data breach?
• Do staff know who to report potential personal data breaches to?
• Do you have a process to document all breaches even if not notifiable?
• Do you know what information you need to provide the ICO in the case of a notifiable breach?
• Do you know how you will investigate breaches?
• Do you know what information you need to provide to a data subject in the case of a notifiable breach?
• Do you have a process to assess the likely risk to individuals as a result of a breach?
• Do you know where all personal data is held so you can identify who may be affected by a breach?

The ICO is the regulator for data protection in the UK and has its own website and helpline.

ICAEW members, affiliates, ICAEW students and staff in eligible firms with member firm access can discuss their specific situation with the Technical Advisory Service on +44 (0)1908 248 250 or via webchat.

The following examples are intended to provide indicative guidance on whether the ICO and/or the data subject(s) need to be notified in a number of situations and are designed to explore general principles contained within the European Data Protection Board’s (EDPB) Guidelines on Personal data breach notification. The discussion forms an important part of the table.