Personal Data Breach Response Policy
Last updated: 24 October 2026
Policy owner: Dr. Henna Safiyah Malik. Contact: hennamaikuk@gmail.com.
Reporting an incident
Report suspected loss, exposure, alteration, destruction or unauthorised access to patient information immediately to Dr. Henna Safiyah Malik. Include when it happened, the affected service and a safe description of what you observed. Do not email medical records, passwords or sensitive screenshots with the initial report. Staff must not wait for proof before escalating a suspicion.
Ownership and first response
Dr. Henna Safiyah Malik coordinates the response with the technical administrator and the affected clinic’s medical director. Record the time the incident was reported and when the organisation became aware of a personal data breach. Assign an incident reference, response owner and action log. Urgent patient-safety concerns must be escalated to the treating clinician immediately.
Containment and evidence
The technical administrator must isolate affected systems, revoke compromised sessions and credentials, restrict exposed data and preserve relevant logs and evidence. Keep a record of actions and their times. Avoid destroying evidence during remediation. Maintain safe clinical continuity with the clinic while affected services are restricted.
Assessment and coordination
Identify affected data, people, recipients, systems and likely consequences, giving particular attention to the sensitivity of health information. Determine whether the operator is acting as controller or processor for the affected processing. Where acting as processor, notify the relevant controller immediately and assist its response. Document the notification decision and reassess it when new facts become available.
Regulatory and patient notification
Where a breach may cause damage to individuals’ privacy or personal data, the responsible controller must notify the competent NCSA authority and affected individuals. The NCSA Personal Data Breach Notifications guideline specifies notification within 72 hours of awareness. Send available information within that period rather than waiting for a complete investigation; explain missing information and provide follow-up updates. Record any delay and its reasons.
Contents of a notification
Describe the nature and timing of the breach, categories and approximate numbers of affected people and records where known, likely consequences, containment and remediation, the contact point and practical protective steps. Use clear language and a secure channel. Do not expose another patient’s information in a notification. Preserve a copy of all notices and correspondence.
Recovery and review
Before restoring normal operation, test the corrective measures and confirm that access is appropriately restricted. Monitor for recurrence, communicate relevant updates and document closure approval. Complete a lessons-learned review, assign corrective actions and track them to completion. Conduct a response exercise at least annually. Maintain a restricted incident register, including incidents that did not require external notification.