Privacy breach response procedure
SOP template
Check this template against your local regulations and your own policies before you use it.
| SOP no. | Version | Effective date | |||
|---|---|---|---|---|---|
| Owner | Approver | Review date |
Purpose
To limit the harm when client information is exposed, and meet the privacy law’s notification rules.
Scope
Any loss of, or unauthorised access to, client information, on paper or electronically.
Responsibilities
| Role | Responsibility |
|---|---|
| All staff | Report any suspected breach to the privacy officer straight away. |
| Privacy officer | Leads the response, decides on notification and keeps the register. |
Procedure
Report it
Tell the privacy officer at once, with what happened and what information is involved.
Contain it
Recall the email, change passwords, lock accounts or retrieve the documents.
Assess the harm
Work out what information was exposed, whose, and whether it could cause serious harm such as identity fraud.
Notify
If the law requires it, notify affected clients and the privacy regulator, saying what happened and what they should do.
Caution: Notification time limits can be short. Start the assessment the same day.
Fix and review
Fix the cause, record the breach in the register and review whether training or systems need to change.
Records
- The breach register.
- The assessment and any notifications sent.
Related documents
- Client identification procedure
Revision history
| Version | Date | What changed | Approved by |
|---|---|---|---|
