1. Immediate Action & Containment
Any staff member who suspects a data breach (e.g., unauthorised access, accidental deletion, or data sent to the wrong person) must immediately notify the Data Protection Leads at info@squareclubmaths.com. The Leads will take immediate steps to secure systems, revoke access, or change passwords to contain the breach.
2. Assessment & Notification
- Assessing Risk: The Data Protection Leads will assess the severity of the breach.
- Notifying the School: If the breach involves Pupil Data, Square Club Maths Ltd (acting as the Processor) will notify the affected School (the Controller) without undue delay, typically within 24 hours.
- Notifying the ICO: If the breach poses a high risk to individuals' rights and freedoms, the ICO must be notified within 72 hours.
3. Record Keeping
All breaches, regardless of severity or ICO notification requirements, must be documented in the internal Personal Data Breach Register.