--- title: Managing Data Breaches Under GDPR Regulations description: "GDPR #7 focuses on preparing for the worst: what to do if there is a breach of personal data security in your organisation." --- [mailto:](mailto:) - [0845 50 50 003](tel:08455050003) - [boxtransfer@cas.ltd](mailto:boxtransfer@cas.ltd) - [Scan On Demand](https://scanondemand.cas.ltd/login.php) - [Online Login](https://boxtransfer.clarksarchivestorage.com/scripts/psonlineisapi.dll/9aufxDRZpnGiOwrcLNwYfRwV7OO/) [![CAS Digital & Archive Document Storage](https://www.cas.ltd/hubfs/raw_assets/public/CAS_Dec2020/images/logo.png "CAS Digital & Archive Document Storage")](https://www.cas.ltd/) - [Document Storage](https://www.cas.ltd/document-storage/business-document-storage/) - [Document Storage](https://www.cas.ltd/document-storage/business-document-storage/) - [Document Storage](https://www.cas.ltd/document-storage/document-storage-service) - [Archive Storage](https://www.cas.ltd/document-storage/archive) - [Digital Storage](https://www.cas.ltd/digital-storage/digital-documents) - [Digital Document Storage](https://www.cas.ltd/digital-storage/digital-documents) - [CAS Cloud](https://www.cas.ltd/digital-storage/cas-cloud) - [Live File Storage System](https://www.cas.ltd/digital-storage/live-file-storage) - [Document Scanning](https://www.cas.ltd/digital-storage/digital-documents) - [Scanning on Demand](https://www.cas.ltd/document-scanning/scanning-on-demand) - [Bulk Scanning](https://www.cas.ltd/document-scanning/bulk-scanning) - [Medical Records Scanning](https://www.cas.ltd/document-scanning/medical-records-scanning) - [Shredding & Disposal](https://www.cas.ltd/shredding/document-shredding) - [Shredding](https://www.cas.ltd/shredding/document-shredding) - [Document Shredding](https://www.cas.ltd/shredding/document-shredding) - [Bulk Shredding](https://www.cas.ltd/shredding/bulk-shredding) - [Medical Document Shredding](https://www.cas.ltd/shredding/medical-document-shredding) - [Disposal](https://www.cas.ltd/disposal/it-equipment) - [Box Recycling](https://www.cas.ltd/disposal/box-recycling) - [Disposal of IT Equipment](https://www.cas.ltd/disposal/it-equipment) - [Printer Disposal](https://www.cas.ltd/disposal/printers) - [Boxes & Supplies](https://www.cas.ltd/boxes/document-storage-boxes) - [Boxes](https://www.cas.ltd/boxes/document-storage-boxes) - [Document Storage Boxes](https://www.cas.ltd/boxes/document-storage-boxes) - [Triple Walled Corrugated Boxes](https://www.cas.ltd/boxes/triple-walled-corrugated-boxes) - [Lloyd George Boxes](https://www.cas.ltd/boxes/lloyd-george-boxes) - [Office Supplies](https://www.cas.ltd/office-supplies/office-supplies) - [Office Supplies](https://www.cas.ltd/office-supplies/office-supplies) - [Office Removals and Storage](https://www.cas.ltd/office-supplies/office-removals-and-storage) - [Virtual Post Room](https://www.cas.ltd/office-supplies/virtual-post-room) - [PPE Santising Products](https://www.cas.ltd/office-supplies/ppe-sanitising-products) - [Document Storage Bags](https://www.cas.ltd/office-supplies/document-storage-bags) - Industries - [Medical Records](https://www.cas.ltd/industries/medical-records-storage) - [Financial Records](https://www.cas.ltd/industries/financial-records-storage/) - Business - [Business Documents](https://www.cas.ltd/industries/business-document-storage) - [SME Document Storage](https://www.cas.ltd/document-storage/sme) - Education - [School Documents](https://www.cas.ltd/industries/school-document-storage) - [University Documents](https://www.cas.ltd/industries/university-document-storage) - [Blog](https://www.cas.ltd/blog) - [Contact Us](https://www.cas.ltd/contact) - Where to Find Us - [Essex](https://www.cas.ltd/where-to-find-us/essex) - [London](https://www.cas.ltd/where-to-find-us/london) - [Kent](https://www.cas.ltd/where-to-find-us/kent) - [Hertfordshire](https://www.cas.ltd/where-to-find-us/hertfordshire) - [Surrey](https://www.cas.ltd/where-to-find-us/surrey) - [Norwich](https://www.cas.ltd/where-to-find-us/norwich) - [Slough](https://www.cas.ltd/where-to-find-us/slough) - [Oxford](https://www.cas.ltd/where-to-find-us/oxford) - [Reading](https://www.cas.ltd/where-to-find-us/reading) - [Northampton](https://www.cas.ltd/where-to-find-us/northampton) - [Cambridge](https://www.cas.ltd/where-to-find-us/cambridge) - [Ipswich](https://www.cas.ltd/where-to-find-us/ipswich) - [Southend-On-Sea](https://www.cas.ltd/where-to-find-us/southend) - [Basildon](https://www.cas.ltd/where-to-find-us/basildon) - [Chelmsford](https://www.cas.ltd/where-to-find-us/chelmsford) - Important Information - [Retention Schedule](https://www.cas.ltd/retention-schedule) - [Data and Document Retention](https://www.cas.ltd/data-and-document-retention) - [GDPR Guide](https://www.cas.ltd/data-gdpr-guide) - [About Us](https://www.cas.ltd/about) - [About Us](https://www.cas.ltd/about) - [Contact Us](https://www.cas.ltd/contact) - [Contact Us](https://www.cas.ltd/contact) - [Document Storage](https://www.cas.ltd/document-storage/business-document-storage/) - [Document Storage](https://www.cas.ltd/document-storage/business-document-storage/) - [Document Storage](https://www.cas.ltd/document-storage/document-storage-service) - [Archive Storage](https://www.cas.ltd/document-storage/archive) - [Digital Storage](https://www.cas.ltd/digital-storage/digital-documents) - [Digital Document Storage](https://www.cas.ltd/digital-storage/digital-documents) - [CAS Cloud](https://www.cas.ltd/digital-storage/cas-cloud) - [Live File Storage System](https://www.cas.ltd/digital-storage/live-file-storage) - [Document Scanning](https://www.cas.ltd/digital-storage/digital-documents) - [Scanning on Demand](https://www.cas.ltd/document-scanning/scanning-on-demand) - [Bulk Scanning](https://www.cas.ltd/document-scanning/bulk-scanning) - [Medical Records Scanning](https://www.cas.ltd/document-scanning/medical-records-scanning) - [Shredding & Disposal](https://www.cas.ltd/shredding/document-shredding) - [Shredding](https://www.cas.ltd/shredding/document-shredding) - [Document Shredding](https://www.cas.ltd/shredding/document-shredding) - [Bulk Shredding](https://www.cas.ltd/shredding/bulk-shredding) - [Medical Document Shredding](https://www.cas.ltd/shredding/medical-document-shredding) - [Disposal](https://www.cas.ltd/disposal/it-equipment) - [Box Recycling](https://www.cas.ltd/disposal/box-recycling) - [Disposal of IT Equipment](https://www.cas.ltd/disposal/it-equipment) - [Printer Disposal](https://www.cas.ltd/disposal/printers) - [Boxes & Supplies](https://www.cas.ltd/boxes/document-storage-boxes) - [Boxes](https://www.cas.ltd/boxes/document-storage-boxes) - [Document Storage Boxes](https://www.cas.ltd/boxes/document-storage-boxes) - [Triple Walled Corrugated Boxes](https://www.cas.ltd/boxes/triple-walled-corrugated-boxes) - [Lloyd George Boxes](https://www.cas.ltd/boxes/lloyd-george-boxes) - [Office Supplies](https://www.cas.ltd/office-supplies/office-supplies) - [Office Supplies](https://www.cas.ltd/office-supplies/office-supplies) - [Office Removals and Storage](https://www.cas.ltd/office-supplies/office-removals-and-storage) - [Virtual Post Room](https://www.cas.ltd/office-supplies/virtual-post-room) - [PPE Santising Products](https://www.cas.ltd/office-supplies/ppe-sanitising-products) - [Document Storage Bags](https://www.cas.ltd/office-supplies/document-storage-bags) - Industries - [Medical Records](https://www.cas.ltd/industries/medical-records-storage) - [Financial Records](https://www.cas.ltd/industries/financial-records-storage/) - Business - [Business Documents](https://www.cas.ltd/industries/business-document-storage) - [SME Document Storage](https://www.cas.ltd/document-storage/sme) - Education - [School Documents](https://www.cas.ltd/industries/school-document-storage) - [University Documents](https://www.cas.ltd/industries/university-document-storage) - [Blog](https://www.cas.ltd/blog) - [Contact Us](https://www.cas.ltd/contact) - Where to Find Us - [Essex](https://www.cas.ltd/where-to-find-us/essex) - [London](https://www.cas.ltd/where-to-find-us/london) - [Kent](https://www.cas.ltd/where-to-find-us/kent) - [Hertfordshire](https://www.cas.ltd/where-to-find-us/hertfordshire) - [Surrey](https://www.cas.ltd/where-to-find-us/surrey) - [Norwich](https://www.cas.ltd/where-to-find-us/norwich) - [Slough](https://www.cas.ltd/where-to-find-us/slough) - [Oxford](https://www.cas.ltd/where-to-find-us/oxford) - [Reading](https://www.cas.ltd/where-to-find-us/reading) - [Northampton](https://www.cas.ltd/where-to-find-us/northampton) - [Cambridge](https://www.cas.ltd/where-to-find-us/cambridge) - [Ipswich](https://www.cas.ltd/where-to-find-us/ipswich) - [Southend-On-Sea](https://www.cas.ltd/where-to-find-us/southend) - [Basildon](https://www.cas.ltd/where-to-find-us/basildon) - [Chelmsford](https://www.cas.ltd/where-to-find-us/chelmsford) - Important Information - [Retention Schedule](https://www.cas.ltd/retention-schedule) - [Data and Document Retention](https://www.cas.ltd/data-and-document-retention) - [GDPR Guide](https://www.cas.ltd/data-gdpr-guide) - [About Us](https://www.cas.ltd/about) - [About Us](https://www.cas.ltd/about) - [Contact Us](https://www.cas.ltd/contact) - [Contact Us](https://www.cas.ltd/contact) # GDPR #7 Personal Data Security: Managing Breaches **Our recent series of blogs covers the General Data Protection Regulation (GDPR) which will be effective from May 2018. We’ve looked at various aspects of data protection rights for individuals, and responsibilities for organisations. This week, our focus is on preparing for the worst: what to do if there is a breach of personal data security in your organisation.** ## [![Contact Us Now](https://no-cache.hubspot.com/cta/default/8508503/a9c71648-0fbc-414a-a650-278700f7391b.png)](https://cta-redirect.hubspot.com/cta/redirect/8508503/a9c71648-0fbc-414a-a650-278700f7391b) ## Letting the authorities know there’s been a breach of personal data security The GDPR will introduce a duty on all organisations to report certain types of breach of personal data security to the relevant supervisory authority, and in some cases to the individuals affected. In the UK, this authority is the [Information Commissioner’s Office (ICO)](https://ico.org.uk/for-organisations/data-protection-reform/overview-of-the-gdpr/introduction/). The ICO is an independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals. A breach of personal data security under the GDPR means an infringement of security leading to the destruction, loss, alteration, unauthorised disclosure of, or non-consensual access to personal data. This means that a breach is more than just losing personal data. For instance, a patient’s health record may be inappropriately accessed at a hospital due to a lack of appropriate internal controls. A UK organisation only has to notify the ICO of a breach where it is likely to result in a significant detrimental effect to the rights and freedoms of individuals. The breach is notifiable if it were to result in discrimination, damage to reputation, financial loss, loss of confidentiality, or other significant economic or social disadvantage to the individual in question. This has to be assessed on a case-by-case basis. An organisation will need to notify the ICO about a loss of customer details which risks identity theft, but would not have to notify the ICO of an inappropriate alteration of a staff telephone list. A notifiable breach has to be reported to the ICO within 72 hours of the organisation becoming aware of it. The GDPR recognises that it will often be impossible to investigate a breach fully within that time-period, and allows an organisation to provide information in phases. But if the breach is sufficiently serious to warrant notification to the public, the organisation responsible must do so without undue delay. Most importantly, any failure to report a notifiable breach can result in a fine of up to EUR10 million (£8.7 million), or 2 per cent of an organisation’s global turnover. ## Informing an individual that their personal data has been compromised Where a breach of personal data security is likely to result in a ‘high risk’ to the rights and freedoms of individuals, an organisation must also notify those concerned directly. It’s worth noting that this threshold for notifying individuals is higher than that for notifying the ICO. An organisation would have to notify the affected individual of certain aspects of the breach. First, it must inform the person of the nature of the personal data breach, including the categories and approximate number of individuals and personal data records concerned. Obviously, it would need to include the name and contact details of the data protection officer (if your organisation has one) or other contact point where more information can be obtained. Crucially, the organisation has to describe the likely consequences of the personal data breach, specify the measures taken to deal with the breach and, where appropriate, outline the measures taken to mitigate any possible adverse effects. ## Preparing your organisation for breach reporting Every organisation in the UK which holds personal data should make sure that their entire staff understands what constitutes a data breach, and that this is more than simply a loss of personal data. This will translate to ensuring that an internal breach reporting procedure is in place, in order to facilitate decision-making about whether it is required to notify the ICO or the public. In light of the tight timescales for reporting a breach, such a procedure must encompass robust breach detection, investigation and internal reporting. The ICO will be publishing specific guidance on personal data breaches, and how organisations can prepare themselves for breach reporting, later in 2017. We’ll bring your attention to this guidance in a later blog. In the meantime, why not have a look at the ICO’s handy ‘[12 steps to take now](https://ico.org.uk/media/for-organisations/documents/1624219/preparing-for-the-gdpr-12-steps.pdf)’ document available on its website, covering various aspects of the GDPR. It goes without saying that CAS is fully compliant with current data protection regulation, and future-proofed for the new GDPR regime too. Whether it’s our document storage or [scan-on-demand](https://www.cas.ltd/scanning-on-demand) services, we’ll keep your data safe and secure. And if you use our [office removal](https://www.cas.ltd/office-removals-and-storage) and [data disposal](https://www.cas.ltd/safe-secure-disposal-of-it-equipment) services, data protection is always a primary consideration for us. [Call one of the CAS team now](https://www.cas.ltd/contact) if you’ve got any questions about any of our services. **[Call one of the CAS team now](https://www.cas.ltd/contact) if you’ve got any questions about document shredding or any of our other services.** - Email: [Info@CAS.ltd](mailto:Info@CAS.ltd) - Call: 0845 50 50 003 - [Website](https://www.cas.ltd/) - [Twitter](https://www.twitter.com/Clarksarchive) - [Facebook](https://www.facebook.com/CAS-Clarks-Archive-Document-Storage-UK-147182775338958/) ## About Clarks CAS CAS provides comprehensive and secure document digitisation, information storage and facilities management services. For more than 20 years CAS have worked with NHS Trusts, Financial Services providers, and corporate and private clients. Our head office is just four miles from the City of London, supported by our advanced storage centres across the UK. CAS has an impressive array of International certifications (ISOs), which prove our compliance with the strictest national, European and international laws. They also demonstrate our commitment to provide innovative systems on security, confidentiality and quality control in keeping your files safe and well managed. CAS, offering 20 years of secure document storage in London. [![New call-to-action](https://no-cache.hubspot.com/cta/default/8508503/0092644a-ac19-4df1-9217-205fefd90184.png)](https://cta-redirect.hubspot.com/cta/redirect/8508503/0092644a-ac19-4df1-9217-205fefd90184) #### Follow Us - - ### Recent Posts ### Categories - [accountancy (1)](https://www.cas.ltd/blog/tag/accountancy) - [archive storage (17)](https://www.cas.ltd/blog/tag/archive-storage) - [Archive storage London (47)](https://www.cas.ltd/blog/tag/archive-storage-london) - [Basildon (1)](https://www.cas.ltd/blog/tag/basildon) - [Benefits of document storage (66)](https://www.cas.ltd/blog/tag/benefits-of-document-storage) - [Box shredding (2)](https://www.cas.ltd/blog/tag/box-shredding) - [Boxing (2)](https://www.cas.ltd/blog/tag/boxing) - [Cambridge (1)](https://www.cas.ltd/blog/tag/cambridge) - [CAS news (25)](https://www.cas.ltd/blog/tag/cas-news) - [Cataloguing (11)](https://www.cas.ltd/blog/tag/cataloguing) - [cataloguing (2)](https://www.cas.ltd/blog/tag/cataloguing-2) - [Chelmsford (1)](https://www.cas.ltd/blog/tag/chelmsford) - [Cloud Storage (48)](https://www.cas.ltd/blog/tag/cloud-storage) - [confidential files (14)](https://www.cas.ltd/blog/tag/confidential-files) - [confidential shredding (4)](https://www.cas.ltd/blog/tag/confidential-shredding) - [DBS Checks (1)](https://www.cas.ltd/blog/tag/dbs-checks) - [Digital Delivery (1)](https://www.cas.ltd/blog/tag/digital-delivery) - [Digital Delivery Service (1)](https://www.cas.ltd/blog/tag/digital-delivery-service) - [digital document management (7)](https://www.cas.ltd/blog/tag/digital-document-management) - [document boxes (4)](https://www.cas.ltd/blog/tag/document-boxes) - [Document management (88)](https://www.cas.ltd/blog/tag/document-management) - [Document Retention (7)](https://www.cas.ltd/blog/tag/document-retention) - [document retention policy (4)](https://www.cas.ltd/blog/tag/document-retention-policy) - [Document scanning (43)](https://www.cas.ltd/blog/tag/document-scanning) - [Document shredding (30)](https://www.cas.ltd/blog/tag/document-shredding) - [document shredding (8)](https://www.cas.ltd/blog/tag/document-shredding-2) - [Document shredding London (18)](https://www.cas.ltd/blog/tag/document-shredding-london) - [document storage (28)](https://www.cas.ltd/blog/tag/document-storage) - [Document storage boxes (13)](https://www.cas.ltd/blog/tag/document-storage-boxes) - [document storage boxes (8)](https://www.cas.ltd/blog/tag/document-storage-boxes-2) - [Document storage London (29)](https://www.cas.ltd/blog/tag/document-storage-london) - [Electronic document storage (44)](https://www.cas.ltd/blog/tag/electronic-document-storage) - [Facilities Management (15)](https://www.cas.ltd/blog/tag/facilities-management) - [Financial records storage (35)](https://www.cas.ltd/blog/tag/financial-records-storage) - [financial services (7)](https://www.cas.ltd/blog/tag/financial-services) - [GDPR (42)](https://www.cas.ltd/blog/tag/gdpr) - [GP practice (1)](https://www.cas.ltd/blog/tag/gp-practice) - [health and safety hazards (4)](https://www.cas.ltd/blog/tag/health-and-safety-hazards) - [Historical document storage London (17)](https://www.cas.ltd/blog/tag/historical-document-storage-london) - [Ipswich (1)](https://www.cas.ltd/blog/tag/ipswich) - [ISO (3)](https://www.cas.ltd/blog/tag/iso) - [IT data disposal (6)](https://www.cas.ltd/blog/tag/it-data-disposal) - [IT equipment disposal (5)](https://www.cas.ltd/blog/tag/it-equipment-disposal) - [Legal document storage (5)](https://www.cas.ltd/blog/tag/legal-document-storage) - [legal documents storage (7)](https://www.cas.ltd/blog/tag/legal-documents-storage) - [Legal documents storage London (30)](https://www.cas.ltd/blog/tag/legal-documents-storage-london) - [Local Services (3)](https://www.cas.ltd/blog/tag/local-services) - [Logistics (2)](https://www.cas.ltd/blog/tag/logistics) - [managing documents (2)](https://www.cas.ltd/blog/tag/managing-documents) - [medical records (10)](https://www.cas.ltd/blog/tag/medical-records) - [Medical records storage (74)](https://www.cas.ltd/blog/tag/medical-records-storage) - [Mighty Mike Evans (1)](https://www.cas.ltd/blog/tag/mighty-mike-evans) - [Mike Evans (1)](https://www.cas.ltd/blog/tag/mike-evans) - [Mike Evans Junior (1)](https://www.cas.ltd/blog/tag/mike-evans-junior) - [NHS (3)](https://www.cas.ltd/blog/tag/nhs) - [NHS medical records (46)](https://www.cas.ltd/blog/tag/nhs-medical-records) - [Office moves London (2)](https://www.cas.ltd/blog/tag/office-moves-london) - [Office relocation London (2)](https://www.cas.ltd/blog/tag/office-relocation-london) - [Office removals London (10)](https://www.cas.ltd/blog/tag/office-removals-london) - [Office supplies (3)](https://www.cas.ltd/blog/tag/office-supplies) - [Offsite document storage (36)](https://www.cas.ltd/blog/tag/offsite-document-storage) - [Outsourcing document storage (33)](https://www.cas.ltd/blog/tag/outsourcing-document-storage) - [Peterborough (2)](https://www.cas.ltd/blog/tag/peterborough) - [Post Scanning (7)](https://www.cas.ltd/blog/tag/post-scanning) - [record retention schedule (3)](https://www.cas.ltd/blog/tag/record-retention-schedule) - [save time searching for documents (1)](https://www.cas.ltd/blog/tag/save-time-searching-for-documents) - [Scan On Demand (9)](https://www.cas.ltd/blog/tag/scan-on-demand) - [scanning medical records (4)](https://www.cas.ltd/blog/tag/scanning-medical-records) - [school document storage (1)](https://www.cas.ltd/blog/tag/school-document-storage) - [Secure documant management (2)](https://www.cas.ltd/blog/tag/secure-documant-management) - [secure document shredding (5)](https://www.cas.ltd/blog/tag/secure-document-shredding) - [secure document storage (16)](https://www.cas.ltd/blog/tag/secure-document-storage) - [secure document storage boxes (4)](https://www.cas.ltd/blog/tag/secure-document-storage-boxes) - [secure online storage (3)](https://www.cas.ltd/blog/tag/secure-online-storage) - [Security Document Storage (14)](https://www.cas.ltd/blog/tag/security-document-storage) - [shredding (2)](https://www.cas.ltd/blog/tag/shredding) - [shredding bins (1)](https://www.cas.ltd/blog/tag/shredding-bins) - [small business services (4)](https://www.cas.ltd/blog/tag/small-business-services) - [specialist document storage (2)](https://www.cas.ltd/blog/tag/specialist-document-storage) - [Subject access and detection request (1)](https://www.cas.ltd/blog/tag/subject-access-and-detection-request) - [Suffolk (2)](https://www.cas.ltd/blog/tag/suffolk) - [Uncategorized (25)](https://www.cas.ltd/blog/tag/uncategorized) - [Virtual Post Room (4)](https://www.cas.ltd/blog/tag/virtual-post-room) - [WEEE disposal (5)](https://www.cas.ltd/blog/tag/weee-disposal) #### Opening Times:   Monday - 9:00am - 5:00pm Tuesday - 9:00am - 5:00pm Wednesday - 9:00am - 5:00pm Thursday - 9:00am - 5:00pm Friday - 9:00am - 5:00pm Saturday - Closed Sunday - Closed #### London Office 1 Whitings Way London E6 6LR [Tel: 0845 505 0003](tel:0845050003) [boxtransfer@cas.ltd](mailto:boxtransfer@cas.ltd?subject=Website%20Enquiry%20from%20cas.ltd) [Privacy Policy](https://www.cas.ltd/privacy-policy) [![CAS Accreditations](https://www.cas.ltd/hs-fs/hubfs/CAS%20Accreditations.png?width=252&height=142&name=CAS%20Accreditations.png)](https://www.cas.ltd/hubfs/CAS%20Accreditations%20September%202025.pdf)   #### CAS A trading name of Clarks Archive Storage Ltd. Covering: London, Essex, East Anglia and the Midlands Registered Office: 61 Station Road, Sudbury, Suffolk. CO10 2SP Company Reg. No. 3241913 VAT Reg. No. 681 0237 53 - [Secure Document Storage in Cambridge](https://www.cas.ltd/where-to-find-us/cambridge) - [Secure document storage in Chelmsford](https://www.cas.ltd/where-to-find-us/chelmsford) - [Secure Document Storage in Ipswich](https://www.cas.ltd/where-to-find-us/ipswich) - [Secure Document Storage in Basildon](https://www.cas.ltd/where-to-find-us/basildon) - [Secure Document Storage in Essex](https://www.cas.ltd/where-to-find-us/essex) - - - -