Chapter 11 — Incidents and reporting to trustees
Lesson map
Lesson 11 published. Map, example, EX051.
flowchart TD
N0["Learning outcomes"]
N1["11.1 An incident"]
N2["11.2 Assessing and notifying"]
N3["11.3 Learning"]
N4["11.4 Reporting to trustees"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX051"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["11.1 An incident"]
N2["11.2 Assessing and notifying"]
N3["11.3 Learning"]
N4["11.4 Reporting to trustees"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX051"]
[Learning outcomes]
|
v
[11.1 An incident]
|
v
[11.2 Assessing and notifying]
|
v
[11.3 Learning]
|
v
[11.4 Reporting to trustees]
|
v
[Worked example] --> [Exercise EX051]
Learning outcomes
You will (1) handle a data incident; (2) decide when to notify; (3) report governance progress to trustees.
11.1 An incident
A volunteer leaves a folder with five referral forms on a bus. She reports it to her lead within the hour, following the guide. Grace starts the incident procedure: record what happened, try to recover the folder, assess the risk and decide on notification. The bus company has no record of the folder. The forms contain names, addresses, household details and, on one form, a health condition. Grace writes down the contents of the forms from the lead's memory and the case system, so the risk can be assessed accurately.
11.2 Assessing and notifying
Grace and the external data protection officer assess the risk. The data are sensitive, involve vulnerable people and cannot be recovered. They decide the incident is likely to result in a risk to individuals and report it to the supervisory authority within seventy-two hours, as the GDPR requires. Because the risk to the families is high, they also inform them directly, explaining what happened and offering support. Each step is recorded. The supervisory authority acknowledges the report and asks a few questions, which Grace answers using her records.
11.3 Learning
The review finds that the volunteer took forms home to phone families because the charity phone was busy. Grace arranges a second charity phone at that food bank and reminds volunteers that forms never leave the premises. The review is blameless; the volunteer is thanked for reporting quickly. Mr. Nowak notes that fast reporting depends on people feeling safe to admit mistakes, so how the first incident is handled shapes future reporting. The volunteer agrees to help explain the new rules to others at her food bank.
11.4 Reporting to trustees
Grace prepares a quarterly report for trustees: progress on goals, the inventory status, consent improvement, quality checks, access reviews, requests handled and incidents with lessons. She uses a simple table with green, amber and red ratings and short explanations. The trustees ask about the bus incident and approve funding for more charity phones. Grace notes that honest reporting of incidents builds trustees' confidence that governance is working. She keeps the report to two pages, with a short paragraph on each red or amber item explaining what is being done and by whom.
Worked example
Grace manages lost referral forms by recording, assessing with the external officer, reporting within seventy-two hours and informing families, adds a second phone after a blameless review and reports progress to trustees with ratings.
Synthetic case. The incident is synthetic; the GDPR is real. This is not legal advice.
Errors and limits
Blaming volunteers for reported mistakes discourages future reporting.
Exercises
- EX051 — Lost item. What did the volunteer lose? Rubric: 3 = a folder with five referral forms;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX052 — Notification deadline. Within what time was the authority notified? Rubric: 3 = seventy-two hours;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX053 — Families informed. Why were families told directly? Rubric: 3 = the risk to them was high;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX054 — Root cause. Why were the forms taken home? Rubric: 3 = the charity phone was busy;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX055 — Trustee decision. What did trustees fund? Rubric: 3 = more charity phones;; 2 = partly correct;; 1 = other;; 0 = none.
Continue studying — lesson 11 (chapter 11 of 12)
← Chapter 10 · Course chapter index · Chapter 12 →
Continue to the next authored lesson.