Information security incident reporting procedure

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Information security incident reporting procedure"

Transcription

1 Information security incident reporting procedure Responsible Officer Author Date effective from 2009 Ben Bennett, Business Planning & Resources Director Julian Lewis, Governance Manager Date last amended December 2015 Review date December 2018 Version 1.4 Page 1 of 7

2 Introduction 1. NICE is committed to ensuring effective safeguards are applied to the information it holds. NICE therefore uses the Security Policy Framework (SPF) to ensure compliance with Government-wide standards and protocols for information governance. 2. NICE holds a range of confidential information. This includes personal data relating to its staff and to some of the individuals that it works with. NICE also holds commercial in confidence data, plus information from the Health and Social Care Information Centre (HSCIC) that contains anonymised, but patient identifiable information. 3. Reporting of information security incidents helps NICE maintain a safe and secure working environment. It helps protect the confidentiality, integrity and availability of the information and systems accessed and is important for effective risk management. 4. Managing incidents relating to the security of information is a cyclical process of identification, reporting, investigation, resolution and learning to minimise the risk of re-occurrence. 5. All staff members have a responsibility to report information security incidents whether deliberate or accidental. 6. This procedure outlines the main requirements for incident reporting related to information security events only and is designed to ensure the incident is recorded, the event is properly reviewed, corrective action taken where necessary and to provide clarity over accountability and responsibility for actions. 7. Incidents relating to health & safety should be reported in accordance with the Health & Safety Welfare Manual. Any identified fraud should be reported in accordance with the Counter Fraud and Anti-Bribery Policy. Information security 8. An information security incident is defined as the exposure of sensitive personal data or confidential information to unacceptable risk. It may include any actual or potential breach of security which may compromise the confidentiality, integrity or availability of information stored, processed and communicated in relation to NICE business whether in hard copy or electronic format. Each potential incident will be risk assessed on a case by case basis. 9. The term information security incident covers a wide range of events which can vary considerably and it is therefore not possible to detail every single event. The following list gives examples of types of security incidents that should be reported: Page 2 of 7

3 Type of data Sensitive personal data 1 Example Risk of accidental or deliberate disclosure of sensitive personal data e.g..applications for committee membership held on a file drive with general staff access Confidential information including Commercial in Confidence (CiC) and Academic in Confidence (AiC) information Risk of accidental or deliberate access of confidential information by an unauthorised person. e.g. 1. CiC information sent to the wrong recipient e.g. 2. CiC information sent by without password protection or encryption Passwords An unauthorised person has gained access to your account or attempted to gain access using your password e.g. Password/login details left accessible and unsecured to visitors in home worker s home. IT security breach Degraded IT system integrity or loss of system availability posing threat to loss of information or disruption of activity Unauthorised access to data Physical security breach Unauthorised access to secure areas containing confidential information e.g. forced access to a locker containing confidential information or sensitive personal data Theft or loss of portable media Unencrypted laptops or other portable media containing confidential or sensitive personal data lost or stolen e.g. laptop stolen from car 10. This list is not exhaustive and staff must ensure they report any incident where they have a reasonable belief that there is a risk to the security of sensitive personal data or any confidential information. Reporting security incidents 11. Incidents should be reported to the Governance Manager and line manager by . Information on the incident should include a description 1 As defined in Appendix 1 Page 3 of 7

4 of the data lost or stolen, whether it was held in hard copy or portable media, the quantity (if known), where it was lost and the sensitivity of the data (if known). 12. In addition, all information incidents involving an IT security breach should be reported immediately to the IT Team for corrective active action. Security incidents that may have an impact on N3 2 will be reported immediately, by the Associate Director Procurement and IT, to the N3 SP Helpdesk. The Associate Director - Procurement and IT and / or Governance Manager will brief the Business Planning & Resources Director (SIRO) and, if patient information is involved, the Caldicott Guardian. 13. Any incident relating to the confidential information received from the Health and Social Care Information Centre (HSCIC) will be reported to the HSCIC in accordance the conditions set out in the agreement with the HSCIC. 14. Security incidents involving sensitive data should be assessed based on the potential detriment to the individual and / or organisations affected, including possible distress and financial damage together with the volume of data involved. 15. Any IT incident occurring outside secure office premises should be reported immediately to the NICE IT department. The IT department maintains its own system security for portable media and the IT network. 16. The Corporate Office retains a central log of all reported information security incidents. These will be reviewed by the Governance Manager and Associate Director Corporate Office and escalated via the Business Planning & Resources Director as the Senior Information Risk Owner (SIRO) to SMT and the Audit and Risk Committee as necessary. 17. All incidents escalated to the Audit and Risk Committee should include a top line synopsis of the data involved, the nature of the incident, the immediate actions taken in mitigation, and the lessons learnt to minimise the risk of recurrence. 2 N3 Connectivity is the connection between NICE IT systems and the NHS intranet Page 4 of 7

5 Appendix 1 Definition of personal data 1 Personal data is any information: which relate to a living individual who can be identified (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual 2 This definition should be considered in light of the extent to which the data relates to the individual s privacy in their family life, business or professional capacity. 3 Sensitive personal data is information that includes the name of an individual, combined with one or more of the following: Bank / financial / credit card details National Insurance number / Tax, benefit or pension records Passport number / information on immigration status Travel details (for example at immigration control, or Oyster records) Passport number / information on immigration status / personal (non- NICE) travel records Health records Work record Material related to social services (including child protection) or housing case work Conviction / prison / court records / evidence Other sensitive data defined by s.2 of the Data Protection Act 1998 including information relating to: (a) racial or ethnic origin (b) political opinions (c) religious beliefs or other beliefs of a similar nature (d) membership of a trade union (e) physical or mental health or condition (f) sex life (g) the commission or alleged commission by him of any offence (h) any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings. Page 5 of 7

6 Appendix 2 Reporting of information security incidents Minor* Medium Significant No material damage to the reputation of the individual or organisation Minor breach of confidentiality Up to 20 individuals Damage to an individual s reputation / privacy Potentially serious breach Over 20 people affected and media not encrypted Damage to NICE reputation Serious breach of confidentiality or disclosure of sensitive personal data OR over 100 people affected Report to Corporate Office and Business Planning & Resources Director Report to Corporate Office and Business Planning & Resources Director Report to the Audit and Risk Committee Report to Audit and Risk Committee Report to Board Report to the ALB BSU and Senior Departmental Sponsor and / or ICO *all incidents should be assessed on a case by case basis in light of the potential harm that could be done in each case either to an individual or a third party or to NICE. The Business Planning & Resources Director as the Senior Information Risk Owner (SIRO) retains the discretion to escalate the reporting of an incident to the Audit and Risk Committee or Board. Page 6 of 7

7 Appendix A - Version Control Sheet Version Date Author Replaces Comment 1.3 Julian Lewis 1.4 Page 7 of 7

Incident reporting procedure

Incident reporting procedure Incident reporting procedure Responsible Officer Author Date effective from Aug 2009 Date last amended Aug 2009 Review date July 2012 Ben Bennett, Business Planning & Resources Director Julian Lewis, Governance

More information

Data Protection Policy

Data Protection Policy Data Protection Policy Responsible Officer Author Date effective from July 2009 Ben Bennett, Business Planning & Resources Director Julian Lewis, Governance Manager Date last amended December 2012 Review

More information

DATA SECURITY BREACH MANAGEMENT POLICY AND PROCEDURE

DATA SECURITY BREACH MANAGEMENT POLICY AND PROCEDURE DATA SECURITY BREACH MANAGEMENT POLICY AND PROCEDURE 1. INTRODUCTION Annex C 1.1 Surrey Heath Borough Council (SHBC) processes personal data and must respond appropriately against unauthorised or unlawful

More information

Information Governance Management Framework

Information Governance Management Framework Information Governance Management Framework Responsible Officer Author Business Planning & Resources Director Governance Manager Date effective from October 2015 Date last amended October 2015 Review date

More information

Incident Reporting Procedure

Incident Reporting Procedure Incident Reporting Procedure Version: Version 1 Ratified by: HEE Board Date ratified: 20 March 2014 Name and Title of Mike Jones, Corporate Secretary originator/author(s): Name of responsible Director:

More information

Information Incident Management Policy

Information Incident Management Policy Information Incident Management Policy Change History Version Date Description 0.1 04/01/2013 Draft 0.2 26/02/2013 Replaced procedure details with broad principles 0.3 27/03/2013 Revised following audit

More information

PAPER RECORDS SECURE HANDLING AND TRANSIT POLICY

PAPER RECORDS SECURE HANDLING AND TRANSIT POLICY PAPER RECORDS SECURE HANDLING AND TRANSIT POLICY CORPORATE POLICY Document Control Title Paper Records Secure Handling and Transit Policy Author Information Governance Manager ** Owner SIRO/CIARG Subject

More information

Data Protection and Information Security. Procedure for reporting a breach of data security. April 2013

Data Protection and Information Security. Procedure for reporting a breach of data security. April 2013 Data Protection and Information Security Procedure for reporting a breach of data security April 2013 Page 1 of 6 Created on: 01/04/2009 Contents 1 Introduction... 3 2 Data Classification... 3 3 What Is

More information

Risk Management Policy

Risk Management Policy Risk Management Policy Responsible Officer Author Ben Bennett, Business Planning & Resources Director Julian Lewis, Governance Manager Date effective from December 2008 Date last amended December 2012

More information

Policy Document Control Page

Policy Document Control Page Policy Document Control Page Title Title: Data Protection Policy Version: 3 Reference Number: CO59 Keywords: Data, access, principles, protection, Act. Data Subject, Information Supersedes Supersedes:

More information

Procedures on Data Security Breach Management Version Control Date Version Reason Owner Author 16/09/2009 Draft 1 Outline Draft Jackie Groom

Procedures on Data Security Breach Management Version Control Date Version Reason Owner Author 16/09/2009 Draft 1 Outline Draft Jackie Groom Procedures on Data Security Breach Management Version Control Date Version Reason Owner Author 16/09/2009 Draft 1 Outline Draft Jackie Groom Indirani 02/11/2009 Draft 2 Include JG s comments Jackie Groom

More information

Information Security Incident Management Policy. Information Security Incident Management Policy. Policy and Guidance. June 2013

Information Security Incident Management Policy. Information Security Incident Management Policy. Policy and Guidance. June 2013 Information Security Incident Management Policy Policy and Guidance June 2013 Project Name Information Security Incident Management Policy Product Title Policy and Guidance Version Number 1.2 Final Page

More information

INFORMATION GOVERNANCE AND SECURITY 1 POLICY DRAFTED BY: INFORMATION GOVERNANCE LEAD 2 ACCOUNTABLE DIRECTOR: SENIOR INFORMATION RISK OWNER

INFORMATION GOVERNANCE AND SECURITY 1 POLICY DRAFTED BY: INFORMATION GOVERNANCE LEAD 2 ACCOUNTABLE DIRECTOR: SENIOR INFORMATION RISK OWNER INFORMATION GOVERNANCE AND SECURITY 1 POLICY DRAFTED BY: INFORMATION GOVERNANCE LEAD 2 ACCOUNTABLE DIRECTOR: SENIOR INFORMATION RISK OWNER 3 APPLIES TO: ALL STAFF 4 COMMITTEE & DATE APPROVED: AUDIT COMMITTEE

More information

Data Protection Policy

Data Protection Policy Data Protection Policy Date approved by Heads of Service 3 June 2014 Staff member responsible Director of Finance and Corporate Services Due for review June 2016 Data Protection Policy Content Page 1 Purpose

More information

PRIVACY POLICY APPENDIX A PRIVACY BREACH/COMPLAINT PROTOCOL

PRIVACY POLICY APPENDIX A PRIVACY BREACH/COMPLAINT PROTOCOL PRIVACY POLICY APPENDIX A Privacy Breach/Complaint Protocol A. Protocol Statement CONTEXT In managing information, the Department of Justice has the responsibility to: 1) be accountable to the public for

More information

Scottish Rowing Data Protection Policy

Scottish Rowing Data Protection Policy Revision Approved by the Board August 2010 1. Introduction As individuals, we want to know that personal information about ourselves is handled properly, and we and others have specific rights in this

More information

Access to Information: Data Protection and Freedom of Information

Access to Information: Data Protection and Freedom of Information Access to Information: Data Protection and Freedom of Information Records Management Section Data protection: key concepts Personal data Sensitive personal data Data subjects Data protection principles

More information

CORK INSTITUTE OF TECHNOLOGY

CORK INSTITUTE OF TECHNOLOGY CORK INSTITUTE OF TECHNOLOGY DATA PROTECTION POLICY APPROVED BY GOVERNING BODY ON 30 APRIL 2009 INTRODUCTION Cork Institute of Technology is committed to a policy of protecting the rights and privacy of

More information

So the security measures you put in place should seek to ensure that:

So the security measures you put in place should seek to ensure that: Guidelines This guideline offers an overview of what the Data Protection Act requires in terms of information security and aims to help you decide how to manage the security of the personal data you hold.

More information

IG: Third Party Contracts and Contractors Policy

IG: Third Party Contracts and Contractors Policy IG: Third Party Contracts and Contractors Policy Document Summary This policy provides guidance on the Information Governance arrangements that need to be considered and / or implemented when engaging

More information

Rick Parsons Information Governance Officer County Hall 01865 323593 rick.parsons@oxfordshire.gov.uk

Rick Parsons Information Governance Officer County Hall 01865 323593 rick.parsons@oxfordshire.gov.uk Rick Parsons Information Governance Officer County Hall 01865 323593 rick.parsons@oxfordshire.gov.uk 1 THE DATA PROTECTION ACT 1998 2 Requirements of the Act Roles & Responsibilities Best Practice 3 The

More information

University of Oxford. Cancer Epidemiology Unit (CEU) Policy: Information Security Incident Reporting and Management

University of Oxford. Cancer Epidemiology Unit (CEU) Policy: Information Security Incident Reporting and Management University of Oxford Cancer Epidemiology Unit (CEU) Policy: Information Security Incident Reporting and Management Page 1 of 9 Version History Version Issue Date Author Description 1.0 07-Oct-2014 Lucy

More information

Information Incident Management and Reporting Procedures

Information Incident Management and Reporting Procedures Information Incident Management and Reporting Procedures Compliance with all policies, procedures, protocols, guidelines, guidance and standards is a condition of employment. Breach of policy may result

More information

INFORMATION GOVERNANCE POLICY

INFORMATION GOVERNANCE POLICY INFORMATION GOVERNANCE POLICY Primary Intranet Location Information Management & Governance Version Number Next Review Year Next Review Month 7.0 2018 January Current Author Phil Cottis Author s Job Title

More information

Human Resources Policy documents. Data Protection Policy

Human Resources Policy documents. Data Protection Policy Policy documents Aims of the Policy apetito is committed to meeting its obligations under data protection law. As a business, apetito handles a range of Personal Data relating to its customers, staff and

More information

Information Security Policy. Appendix B. Secure Transfer of Information

Information Security Policy. Appendix B. Secure Transfer of Information Information Security Policy Appendix B Secure Transfer of Information Author: Data Protection and Information Security Officer. Version: 0.7 Date: March 2008 Document Control Information Document ID Document

More information

Data Protection Avoiding Information Commissioner Fines. Caroline Egan 5 June 2014

Data Protection Avoiding Information Commissioner Fines. Caroline Egan 5 June 2014 Data Protection Avoiding Information Commissioner Fines Caroline Egan 5 June 2014 Why is data protection a hot topic in pensions? Pension schemes hold large amounts of personal data Individuals more aware

More information

NHS Business Services Authority Information Security Incident Reporting Procedure

NHS Business Services Authority Information Security Incident Reporting Procedure NHS Business Services Authority Information Security Incident Reporting Procedure NHS Business Services Authority Corporate Secretariat NHSBSAIS002 Issue Sheet Document reference NHSBSAIS002 Document location

More information

Will we be in trouble? How information laws are enforced

Will we be in trouble? How information laws are enforced Will we be in trouble? How information laws are enforced Max Todd Information Compliance team, Council Secretariat Wednesday 23 September 2015 Breaches of data security - read all about it London clinic

More information

East Northamptonshire Council Policy & Community Development. Data Protection Policy December 2007

East Northamptonshire Council Policy & Community Development. Data Protection Policy December 2007 East Northamptonshire Council Policy & Community Development Data Protection Policy December 2007 If you would like to receive this publication in an alternative format (large print, tape format or other

More information

NIGB. Information Governance Untoward Incident Reporting and Management Advice for Local Authorities

NIGB. Information Governance Untoward Incident Reporting and Management Advice for Local Authorities Information Governance Untoward Incident Reporting and Management Advice for Local Authorities March 2013 Contents Page 1. The Role of the NIGB.....3 2. Introduction...4 3. Background Information...6 4.

More information

Data Protection Policy

Data Protection Policy Data Protection Policy 1. Introduction and purpose 1.1 Children s Hearings Scotland (CHS) is required to maintain certain personal data about individuals for the purposes of satisfying our statutory, operational

More information

PRIVACY BREACH MANAGEMENT POLICY

PRIVACY BREACH MANAGEMENT POLICY PRIVACY BREACH MANAGEMENT POLICY DM Approval: Effective Date: October 1, 2014 GENERAL INFORMATION Under the Access to Information and Protection of Privacy Act (ATIPP Act) public bodies such as the Department

More information

Notification of data security breaches to the Information Commissioner s

Notification of data security breaches to the Information Commissioner s ICO lo Notification of data security breaches to the Information Commissioner s Data Protection Act Contents Overview... 2 What the DPA says... 2 Reporting a breach... 2 Potential detriment to data subjects...

More information

Checklist Guidance for Reporting, Managing and Investigating Information Governance Serious Incidents Requiring Investigation (IG SIRI)

Checklist Guidance for Reporting, Managing and Investigating Information Governance Serious Incidents Requiring Investigation (IG SIRI) Checklist Guidance for Reporting, Managing and Investigating Information Governance Serious Incidents Requiring Investigation (IG SIRI) Applicable to all organisations processing Health, Public Health

More information

Information Security Incident Management Policy September 2013

Information Security Incident Management Policy September 2013 Information Security Incident Management Policy September 2013 Approving authority: University Executive Consultation via: Secretary's Board REALISM Project Board Approval date: September 2013 Effective

More information

Newcastle Safeguarding Children Board Multi-agency information sharing agreement

Newcastle Safeguarding Children Board Multi-agency information sharing agreement Newcastle Safeguarding Children Board Multi-agency information sharing agreement March 2016 Introduction Newcastle Safeguarding Children Board (NSCB) is the strategic body for promoting and safeguarding

More information

BHCC Policy Summary. This policy outlines BHCC s obligations and responsibilities in relation to the Data Protection Act 1998.

BHCC Policy Summary. This policy outlines BHCC s obligations and responsibilities in relation to the Data Protection Act 1998. BHCC Policy Summary 1 Policy Name Data Protection Policy. 2 Purpose of Policy To define the standards expected of all Brighton & Hove City Council employees, and any third parties, when processing information

More information

Portable Devices and Removable Media Acceptable Use Policy v1.0

Portable Devices and Removable Media Acceptable Use Policy v1.0 Portable Devices and Removable Media Acceptable Use Policy v1.0 Organisation Title Creator Oxford Brookes University Portable Devices and Removable Media Acceptable Use Policy Information Security Working

More information

CARMEL EDUCATION TRUST INFORMATION SECURITY POLICY

CARMEL EDUCATION TRUST INFORMATION SECURITY POLICY CARMEL EDUCATION TRUST INFORMATION SECURITY POLICY Document Management: Date Policy Approved: 29 April 2015 Date Amended: Next Review Date: April 2018 Version: 1.0 Approving Body: Resources Committee Information

More information

Information Incident Management and Reporting Procedures

Information Incident Management and Reporting Procedures ` Information Incident Management and Reporting Procedures Compliance with all CCG policies, procedures, protocols, guidelines, guidance and standards is a condition of employment. Breach of policy may

More information

Checklist Guidance for Reporting, Managing and Investigating Information Governance and Cyber Security Serious Incidents Requiring Investigation

Checklist Guidance for Reporting, Managing and Investigating Information Governance and Cyber Security Serious Incidents Requiring Investigation Checklist Guidance for Reporting, Managing and Investigating Information Governance and Cyber Security Serious Incidents Requiring Investigation Applicable to all organisations processing Health, Public

More information

Data Compliance. And. Your Obligations

Data Compliance. And. Your Obligations Information Booklet Data Compliance And Your Obligations What is Data Protection? It is the safeguarding of the privacy rights of individuals in relation to the processing of personal data. The Data Protection

More information

Safe Haven Policy. Equality & Diversity Statement:

Safe Haven Policy. Equality & Diversity Statement: Title: Safe Haven Policy Reference No: 010/IT Owner: Deputy Chief Officer Author Information Governance Lead First Issued On: November 2012 Latest Issue Date: March 2015 Operational Date: March 2015 Review

More information

Data Protection Procedure

Data Protection Procedure Data Protection Procedure [QP2.28] Procedure Number: QP2.28 Revision Number: 3 Date of issue: January 2006 Status: Approved Date of approval: May 2006 Responsibility for procedure: Director of Information

More information

Information Incident Management. and Reporting Policy

Information Incident Management. and Reporting Policy Information Incident Management and Reporting Policy Policy ID IG10 Version: 1 Date ratified by Governing Body 21/3/2014 Author South CSU Date issued: 21/3/2014 Last review date: N/A Next review date:

More information

ORBIT POLICY O-DPA01 DATA PROTECTION POLICY V1.1

ORBIT POLICY O-DPA01 DATA PROTECTION POLICY V1.1 ORBIT POLICY O-DPA01 DATA PROTECTION POLICY V1.1 1 Document Control Document Title DATA PROTECTION POLICY References O-DPA01 Version V1.1 Classification Unclassified Status Issued Last Review August 2011

More information

Data Protection Breach Reporting Procedure

Data Protection Breach Reporting Procedure Central Bedfordshire Council www.centralbedfordshire.gov.uk Data Protection Breach Reporting Procedure October 2015 Security Classification: Not Protected 1 Approval History Version No Approved by Approval

More information

Data Protection Policy

Data Protection Policy Data Protection Policy September 2015 Contents 1. Scope 2. Purpose 3. Data protection roles 4. Staff training and guidance 5. About the Data Protection Act 1998 6. Policy 7. The Information Commissioner's

More information

DATA PROTECTION POLICY

DATA PROTECTION POLICY DATA PROTECTION POLICY Version 1.3 April 2014 Contents 1 POLICY STATEMENT...2 2 PURPOSE....2 3 LEGAL CONTEXT AND DEFINITIONS...2 3.1 Data Protection Act 1998...2 3.2 Other related legislation.....4 3.3

More information

INFORMATION SECURITY & DATA PROTECTION POLICY. Documentation Control

INFORMATION SECURITY & DATA PROTECTION POLICY. Documentation Control INFORMATION SECURITY & DATA PROTECTION POLICY Documentation Control Reference Date Approved Approving Body GG/INF/002 TRUST BOARD Implementation Date JUNE 2010 Supersedes Consultation Date of Completion

More information

Little Marlow Parish Council Registration Number for ICO Z3112320

Little Marlow Parish Council Registration Number for ICO Z3112320 Data Protection Policy Little Marlow Parish Council Registration Number for ICO Z3112320 Adopted 2012 Reviewed 23 rd February 2016 Introduction The Parish Council is fully committed to compliance with

More information

Information Governance Serious Incident Requiring Investigation Policy and Procedure

Information Governance Serious Incident Requiring Investigation Policy and Procedure Information Governance Serious Incident Requiring Investigation Policy and Procedure Document Control Sheet Name of document: Information Governance Serious Incident Requiring Investigation (SIRI) Policy

More information

NHS Waltham Forest Clinical Commissioning Group Information Governance Strategy

NHS Waltham Forest Clinical Commissioning Group Information Governance Strategy NHS Waltham Forest Clinical Commissioning Group Governance Strategy Author: Zeb Alam, CCG IG Lead, (NELCSU) David Pearce, Head of Governance, WFCCG Version 3.0 Amendments to Version 2.1 Annual Review Reference

More information

Summary Electronic Information Security Policy

Summary Electronic Information Security Policy University of Chichester Summary Electronic Information Security Policy 2015 Summary Electronic Information Security Policy Date of Issue 24 December 2015 Policy Owner Head of ICT, Strategy and Architecture

More information

Data Protection Policy A copy of this policy is published in the following areas: The school s intranet The school s website

Data Protection Policy A copy of this policy is published in the following areas: The school s intranet The school s website Data Protection Policy A copy of this policy is published in the following areas: The school s intranet The school s website Date created: November 2015 Date for review: July 2016 Created by: Mark Vanstone,

More information

Guidance on the Processing of Personal Data for Research Purposes 1

Guidance on the Processing of Personal Data for Research Purposes 1 Guidance on the Processing of Personal Data for Research Purposes 1 1. Background The University of the West of Scotland has a reputation as a provider of high quality applied research. Some of the research

More information

This Policy supersedes the following Policy, which must now be destroyed :

This Policy supersedes the following Policy, which must now be destroyed : Document Title Reference Number Lead Officer Author(s) (name and designation) Ratified by Removable Media: Data Encryption Policy NTW(O)30 Lisa Quinn Executive Director of Performance and Assurance Sue

More information

Data Sharing Protocols

Data Sharing Protocols Data Sharing Protocols Responsible Officer Author Business Planning & Resources Director Corporate Office Date effective from October 2013 Date last amended NA Review date October 2016 Audience NICE Board

More information

Data Protection Policy

Data Protection Policy Data Protection Policy Type: Status: Policy Statutory Issue Status:- Date Version Comment Owner April 2014 1 Original document Julie Taylor Electronic copies of this document are available to download

More information

Policy and Procedure for approving, monitoring and reviewing personal data processing agreements

Policy and Procedure for approving, monitoring and reviewing personal data processing agreements Policy and Procedure for approving, monitoring and reviewing personal data processing agreements 1 Personal data processing by external suppliers, contractors, agents and partners Policy and Procedure

More information

INFORMATION GOVERNANCE OPERATING POLICY & FRAMEWORK

INFORMATION GOVERNANCE OPERATING POLICY & FRAMEWORK INFORMATION GOVERNANCE OPERATING POLICY & FRAMEWORK Log / Control Sheet Responsible Officer: Chief Finance Officer Clinical Lead: Dr J Parker, Caldicott Guardian Author: Associate IG Specialist, Yorkshire

More information

Data Protection Policy

Data Protection Policy Data Protection Policy CONTENTS Introduction...2 1. Statement of Intent...2 2. Fair Processing or Privacy Statement...3 3. Data Uses and Processes...4 4. Data Quality and Integrity...4 5. Technical and

More information

Our Commitment to Information Security

Our Commitment to Information Security Our Commitment to Information Security What is HIPPA? Health Insurance Portability and Accountability Act 1996 The HIPAA Privacy regulations require health care providers and organizations, as well as

More information

DATA PROTECTION POLICY

DATA PROTECTION POLICY Reference number Approved by Information Management and Technology Board Date approved 14 th May 2012 Version 1.1 Last revised N/A Review date May 2015 Category Information Assurance Owner Data Protection

More information

Data Protection Policy

Data Protection Policy Data Protection Policy Prepared By: Malkiat Thiarai Head of Corporate Information Management Date of Publication: December 2015 Version: 6.0 Classification: Not Protectively Marked Page 1 Table of Contents

More information

Personal data - Personal data identify an individual. For example, name, address, contact details, date of birth, NHS number.

Personal data - Personal data identify an individual. For example, name, address, contact details, date of birth, NHS number. Background The Data Protection Act 1998 i came into force in March 2000 and is followed by all NHS employed staff via their policies and procedures. The act applies to all personal, identifiable information

More information

APPENDIX 1: SUPPLIER INSTRUCTIONS FOR THE PROCESSING OF PERSONAL DATA

APPENDIX 1: SUPPLIER INSTRUCTIONS FOR THE PROCESSING OF PERSONAL DATA APPENDIX 1: SUPPLIER INSTRUCTIONS FOR THE PROCESSING OF PERSONAL DATA Purpose SOS International has legal and contractual obligations on the matters of data protection and IT security. As a part of these

More information

Data Processing Agreement

Data Processing Agreement Data Processing Agreement BETWEEN GP Name and practice address (Hereinafter known as the Data Controller) AND Coventry & Rugby Clinical Commissioning Group, of Christchurch House, Greyfriars Lane, Coventry,

More information

Policy: IG01. Information Governance Incident Reporting Policy. n/a. Date ratified: 16 th April 2014

Policy: IG01. Information Governance Incident Reporting Policy. n/a. Date ratified: 16 th April 2014 Policy: IG01 Information Governance Incident Reporting Policy Version: IG01/01 Ratified by: Trust Management Team Date ratified: 16 th April 2014 Title of Author: Head of Governance Title of responsible

More information

Data Protection Policy June 2014

Data Protection Policy June 2014 Data Protection Policy June 2014 Approving authority: Consultation via: Court Audit and Risk Committee, University Executive, Secretary's Board, Information Governance and Security Group Approval date:

More information

HERTSMERE BOROUGH COUNCIL

HERTSMERE BOROUGH COUNCIL HERTSMERE BOROUGH COUNCIL DATA PROTECTION POLICY October 2007 1 1. Introduction Hertsmere Borough Council ( the Council ) is fully committed to compliance with the requirements of the Data Protection Act

More information

INFORMATION RISK MANAGEMENT POLICY

INFORMATION RISK MANAGEMENT POLICY INFORMATION RISK MANAGEMENT POLICY DOCUMENT CONTROL: Version: 1 Ratified by: Steering Group / Risk Management Sub Group Date ratified: 21 November 2012 Name of originator/author: Manager Name of responsible

More information

Merthyr Tydfil County Borough Council. Data Protection Policy

Merthyr Tydfil County Borough Council. Data Protection Policy Merthyr Tydfil County Borough Council Data Protection Policy 2014 Cyfarthfa High School is a Rights Respecting School, we recognise the importance of ensuring that the United Nations Convention of the

More information

Security Incident Policy

Security Incident Policy Organisation Title Author Owner Protective Marking Somerset County Council Security Incident Policy Peter Grogan Information Governance Manager Unclassified POLICY ON A PAGE Somerset County Council will

More information

Human Resources and Data Protection

Human Resources and Data Protection Human Resources and Data Protection Contents 1. Policy Statement... 1 2. Scope... 2 3. What is personal data?... 2 4. Processing data... 3 5. The eight principles of the Data Protection Act... 4 6. Council

More information

RECORDS MANAGEMENT POLICY

RECORDS MANAGEMENT POLICY [Type text] RECORDS MANAGEMENT POLICY POLICY TITLE Academic Year: 2013/14 onwards Target Audience: Governing Body All Staff and Students Stakeholders Final approval by: CMT - 1 October 2014 Governing Body

More information

Content. 3. Who? Who has to carry out an information governance assessment?

Content. 3. Who? Who has to carry out an information governance assessment? Introduction to Information Governance (IG) & the IG Toolkit Content 1. What? What is Information Governance, IG Toolkit, Data, Personal Data, Sensitive Data 2. Why? Information Governance 3. Who? Who

More information

Data Protection Policy

Data Protection Policy London Borough of Enfield Data Protection Policy Author Mohi Nowaz Classification UNCLASSIFIED Date of First Issue 10/08/2012 Owner IGB Issue Status DRAFT Date of Latest Re-Issue 12/09/2012 Version 0.6

More information

Once more unto the breach... Dealing with Personal Data Security Breaches. Helen Williamson Information Governance Officer

Once more unto the breach... Dealing with Personal Data Security Breaches. Helen Williamson Information Governance Officer Once more unto the breach... Dealing with Personal Data Security Breaches Helen Williamson Information Governance Officer Aims of the session What are we going to look at? What is a data security breach?

More information

Guidance on data security breach management

Guidance on data security breach management ICO lo Guidance on data security breach management Data Protection Act Contents... 1 Data Protection Act... 1 Overview... 1 Containment and recovery... 2 Assessing the risks... 3 Notification of breaches...

More information

University of Limerick Data Protection Compliance Regulations June 2015

University of Limerick Data Protection Compliance Regulations June 2015 University of Limerick Data Protection Compliance Regulations June 2015 1. Purpose of Data Protection Compliance Regulations 1.1 The purpose of these Compliance Regulations is to assist University of Limerick

More information

Gloucestershire Information Sharing Partnership Agreement (GISPA) Version 2.0

Gloucestershire Information Sharing Partnership Agreement (GISPA) Version 2.0 Review date: April 2016 Gloucestershire Information Sharing Partnership Agreement (GISPA) Version 2.0 Gloucestershire Authorities Information Management Forum Gloucestershire Information Sharing Partnership

More information

Not Protectively Marked

Not Protectively Marked TITLE CCMT Sponsor Department/Area Section/Sector INFORMATION SECURITY POLICY Deputy Chief Constable Professional Standards Department Force Security 1.0 Rationale 1.1 This policy sets out the approach

More information

Information Security Policy

Information Security Policy Information Security Policy v2.0 Target Audience: Policy Endorsed by: ESCC Staff, members and other agencies handling ESCC information Governance Committee Final V2.0 Page 1 of 13 Information Security

More information

Procedure for Managing a Privacy Breach

Procedure for Managing a Privacy Breach Procedure for Managing a Privacy Breach (From the Privacy Policy and Procedures available at: http://www.mun.ca/policy/site/view/index.php?privacy ) A privacy breach occurs when there is unauthorized access

More information

Data Protection Policy

Data Protection Policy Data Protection Policy 1. Introduction to the Data Protection Policy Everyone who works for Chorley Council uses personal data in the course of their duties. Chorley Council must gather and process personal

More information

Information Security Incident Management Policy and Procedure

Information Security Incident Management Policy and Procedure Information Security Incident Management Policy and Procedure Version Final 1.0 Document Control Organisation Title Author Filename Owner Subject Protective Marking North Dorset District Council IT Infrastructure

More information

Quick Guide To Information Governance Policies

Quick Guide To Information Governance Policies Quick Guide To Information Governance Policies Data Protection The Data Protection Act 1998 established principles and rights in relation to the collection, use and storage of personal information by organisations.

More information

Guidance on data security breach management

Guidance on data security breach management Guidance on data security breach management Organisations which process personal data must take appropriate measures against unauthorised or unlawful processing and against accidental loss, destruction

More information

WEST LOTHIAN COUNCIL DATA PROTECTION ACT 1998 POLICY

WEST LOTHIAN COUNCIL DATA PROTECTION ACT 1998 POLICY WEST LOTHIAN COUNCIL DATA PROTECTION ACT 1998 POLICY Version 3.0 DATA PROTECTION ACT 1998 POLICY CONTENTS 1. INTRODUCTION... 3 2. PROVISIONS OF THE ACT... 4 3. SCOPE... 4 4. GENERAL POLICY STATEMENT...

More information

Data Security Breach Management Procedure

Data Security Breach Management Procedure Academic Services Data Security Breach Management Procedure Document Reference: Data Breach Procedure 1.1 Document Type: Document Status: Document Owner: Review Period: Procedure v1.0 Approved by ISSG

More information

Guidance on Managing Data Breaches

Guidance on Managing Data Breaches Guidance on Managing Data Breaches This guidance covers what to do if you believe there has been a data breach and when it should be notified to the Commissioner. This guidance relates to both the Data

More information

DATA PROTECTION POLICY

DATA PROTECTION POLICY DATA PROTECTION POLICY Approval date: June 2014 Approved by: Board Responsible Manager: Executive Director of Resources Next Review June 2016 Data Protection Policy 1. Introduction Data Protection Policy

More information

All CCG staff. This policy is due for review on the latest date shown above. After this date, policy and process documents may become invalid.

All CCG staff. This policy is due for review on the latest date shown above. After this date, policy and process documents may become invalid. Policy Type Information Governance Corporate Standing Operating Procedure Human Resources X Policy Name CCG IG03 Information Governance & Information Risk Policy Status Committee approved by Final Governance,

More information

SECURITY INCIDENT REPORTING AND MANAGEMENT. Standard Operating Procedures

SECURITY INCIDENT REPORTING AND MANAGEMENT. Standard Operating Procedures SECURITY INCIDENT REPORTING AND MANAGEMENT Standard Operating Procedures Notice: This document has been made available through the Police Service of Scotland Freedom of Information Publication Scheme.

More information

Islington Security Incident Policy A council-wide information technology policy. Version 0.7.1 July 2013

Islington Security Incident Policy A council-wide information technology policy. Version 0.7.1 July 2013 A council-wide information technology policy Version 0.7.1 July 2013 Copyright Notification Copyright London Borough of Islington 2014 This document is distributed under the Creative Commons Attribution

More information

Information Governance Policy and Management Framework

Information Governance Policy and Management Framework Information Governance Policy and Management Framework Policy Number: IG01 Version: 3.0 Ratified by: Governing Body Date ratified: February 2016 Name of originator/author: Louise Chatwyn Information Governance

More information

Key Steps in Responding to Privacy Breaches

Key Steps in Responding to Privacy Breaches Key Steps in Responding to Privacy Breaches Purpose The purpose of this document is to provide guidance to organizations, public bodies, and custodians when a privacy breach occurs. 1 Organizations and

More information

THE MORAY COUNCIL. Guidance on data security breach management DRAFT. Information Assurance Group. Evidence Element 9 appendix 31

THE MORAY COUNCIL. Guidance on data security breach management DRAFT. Information Assurance Group. Evidence Element 9 appendix 31 THE MORAY COUNCIL Guidance on data security breach management Information Assurance Group DRAFT Based on the ICO Guidance on data security breach management under the Data Protection Act 1 Document Control

More information