Data breaches need to be reported to the Legal Office as soon as they are identified. The below documents will give you guidance on how to do that.
Please send your completed Data Breach Reporting Form to the Legal Office at legaloffice@beds.ac.uk
Depending on the severity of the data breach, it may need to be reported to the Information Commissioner's Office (ICO). We have a 72-hour deadline to do so, and this 72-hour clock starts from when you first discover the data breach, not from when the Legal Office receives the data breach report.
Therefore it is important that you report all data breaches to us and your line manager as soon as they are discovered, and in accordance with the timeframe stipulated in our Data Breach Process document.
If your line manager is not available, or is on annual leave, please do not wait for them to return before reporting the breach. Report it to us directly, and cc them into the communication.