Module 1 of 2 · 40 minutes
The principles, and the first hour of a breach
By the end of this module you will be able to
- Apply the principles to a real sharing decision
- Identify special category data and the extra care it needs
- Act correctly in the first hour of a breach
- Handle a subject access request
Work through it
1 interactive for this module, built on the WAJD Teach engine. Nothing moves until you ask it to, and every one has a written version if you would rather read it.
Amara Seven principles. I have been trained on them four times and could not list them.
Nadia Then do not try. Three of them decide almost every real question, and the others are mostly the organisation's problem rather than yours.
Amara Which three?
Nadia Purpose limitation: was it collected for this? Data minimisation: do I need all of it, or just this part? And integrity and confidentiality: is it secure in the way I am about to move it?
Amara Give me a real example.
Nadia A colleague asks you to send a resident's care plan to her personal email so she can read it at home. Run the three. Was it collected for that? No. Does she need all of it? Almost certainly not. Is personal email secure? No. Three noes in about four seconds.
Amara What is special category data?
Nadia Health, race or ethnic origin, religion or belief, political opinions, trade union membership, genetic and biometric data, sex life and sexual orientation. It needs more protection.
Amara In care, that is basically everything.
Nadia It is, and that is exactly why people stop noticing. A diagnosis. A colleague's sickness reason. A dietary requirement that reveals a religion. All special category, all being discussed in corridors.
Amara Right. I have just emailed a care plan to the wrong person. What do I do?
Nadia In order. Contain it, so recall the email. Then report it internally immediately. Manager or data protection lead.
Amara Even if the recall worked?
Nadia Even then, and this is the bit people get wrong out of embarrassment. Recalling an email does not mean it was not read. And the judgement about whether it is reportable is not yours to make, it belongs to the organisation.
Amara What is the rush?
Nadia Seventy two hours to notify the ICO where it is reportable, and that clock starts when the organisation becomes aware. So every hour you spend hoping it will be fine is an hour eaten out of somebody else's deadline.
Amara Is there anything I must not do?
Nadia Do not delete anything and do not try to cover it. That turns a mistake, which happens to everyone, into misconduct, which does not have to happen to anyone.
Amara What actually counts as a breach? It feels like a hacking word.
Nadia Far broader. An email to the wrong recipient. A handover sheet left on a bus. A screen left open in a corridor. A photograph of a wound on a personal phone. A conversation in a lift.
Amara A conversation?
Nadia Unauthorised disclosure of personal data. If you discuss a named resident's condition where visitors can hear, that is a disclosure. Nobody reports it and it is one of the most frequent.
Amara Last thing. Subject access requests.
Nadia Anyone can ask what personal data you hold about them. It does not have to be in writing, does not have to use the words, and does not have to go to a particular person.
Amara So if a daughter asks me what is written about her mother?
Nadia She may have just made one, and the clock may have started. Which is why every member of staff needs to recognise it and pass it on rather than answering it in a corridor.
Amara How long do we have?
Nadia One month, extendable by two more for complex or numerous requests, provided you tell them inside the first month. Normally no fee. And redact other people's data within the record rather than withholding the whole thing, which is the usual overreaction.
The written material
Seven principles, three that decide most questions
UK GDPR sets out seven principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.
In practice three of them decide almost every real question. Purpose limitation: was it collected for this? Data minimisation: do I need all of it, or just this part? Integrity and confidentiality: is it secure in the way I am about to move it?
Run any decision through those three and you will get the right answer far more often than by trying to remember all seven.
Special category data
Some data needs more protection: health, race or ethnic origin, religion or belief, political opinions, trade union membership, genetic and biometric data, sex life and sexual orientation.
Health and care staff handle this constantly and often stop noticing. A resident's diagnosis, a colleague's sickness absence reason, a child's dietary requirement that reveals a religion: all special category.
Criminal offence data is not technically special category but carries its own restrictions. DBS results sit here.
The first hour of a breach
A personal data breach is any breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. That includes a great deal more than hacking: an email to the wrong recipient, a handover sheet left on a bus, a screen left open, a photograph taken on a personal phone, a conversation in a lift.
What to do, in order. Contain it: recall the email, retrieve the document, lock the screen. Do not delete anything or try to cover it, because that turns a mistake into misconduct. Report it internally immediately, to your manager or data protection lead.
The organisation must assess whether it is reportable and, if so, notify the ICO within 72 hours of becoming aware. That clock starts when the organisation becomes aware, which is why an hour of your delay consumes somebody else's deadline. Where there is a high risk to the individuals, they must be told too, without undue delay.
Subject access requests
Anybody can ask what personal data you hold about them. It does not have to be in writing, does not have to say subject access request, and does not have to come to a particular person. A resident's daughter asking a carer what is written about her mother has potentially made one, which is why all staff need to recognise it and pass it on.
One month to respond, extendable by two further months for complex or numerous requests provided you tell the person within the first month. Normally no fee.
You may need to redact third party information: another person's data within the record, unless they consent or it is reasonable to disclose without it. Do not withhold the whole record because part of it mentions somebody else.
Knowledge check
The knowledge check and your certificate need a free account, so that your progress and results can be saved as evidence.
The learning itself stays free and open. You are reading all of it right now without an account.