Learning points

An incident like this can happen all too easily, and it's important that robust practice procedures are in place so data breaches can be correctly detected, investigated, managed and reported. As outlined in the GDC's Standards, dental registrants have a professional responsibility to be honest and act with integrity.

GDPR regulations define a personal data breach as "a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed." In this case, both personal data and sensitive personal data had been accidentally disclosed without authorisation, but in nearly all cases, it is sensible to tell patients about any data breaches that occur.

Not every data breach meets the threshold for notification to the ICO. To identify those that do, members can access the ICO's self-assessment breach tool on the organisation's website.

A data breach in Scotland, Wales and Northern Ireland must be reported via the ICO breach reporting tool in each jurisdiction.

All breach notifications need to include the type of personal data breach, including:

the categories and approximate number of individuals concerned
categories and approximate number of personal data records concerned
name and contact details of DPO or other contact point
description of likely consequences of the breach
description of measures taken or proposed to deal with the breach, including measures to mitigate possible adverse effects.

In-house policies should include a named person (such as the DPO) to lead on the local investigation and incident management into any data breach.

All staff, including trainees, should be aware of what constitutes a data breach, and induction procedures should ensure that all staff receive GDPR training.

Data breach

Data breach