Containment and Recovery
Appropriate steps must be taken immediately to minimise the effect of the breach. An initial assessment will be made to establish the severity of the breach and to establish whether there is anything that can be done to recover any losses and limit the damage the breach could cause.
The investigation will need to take into account the following:
- The type of data involved.
- Any sensitivity for example information relating to children/vulnerable adults.
- The protections that are in place (e.g. encryptions).
- What's happened to the data, has it been lost or stolen.
- Whether the data could be put to any illegal or inappropriate use.
- Who the individuals are, number of individuals involved and the potential effects on those data subject(s).
- Whether there are wider consequences to the breach.