Personal Data Breach Policy

Adopted: 21 September 2026  |  Review Date: September 2027

This personal data breach policy sets out the procedures we have put in place to deal with a breach of the confidentiality integrity or availability of personal data within our organisation.

We are Perranzabuloe Parish Council a council in England.  Our contact details are Perranzabuloe Parish Council, Chyanhale, Ponsmere Valley, Perranporth, TR6 0DB, email: clerk@perranzabuloe-pc.gov.uk

We are a data controller for personal data as defined by all applicable data protection and privacy laws including, but not limited to, the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (the “UK GDPR”), as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 as amended, and any successor legislation (the “Data Protection Legislation”).

This policy is binding on all employees, members and volunteers (“User” or “Users”) of Perranzabuloe Parish Council (“The Organisation”) in order to protect Personal or other Data (“Personal Data” or “Data”) processed by the organisation.

It applies to all organised filing systems be they computer based, paper based or any other such method of organising information which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis (“Filing Systems”).

  1. Definitions

• “Personal data” means any information relating to an identified or identifiable individual (“data subject”); an identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.
• Personal data will typically contain information about the individual or their activities.
• A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, data. This includes breaches that are the result of both accidental and deliberate causes.
• Personal Data breaches can include but are not limited to:
  • Access by an unauthorised third party.
  • Deliberate or accidental action (or inaction) by a controller or processor.
  • Sending personal data to an incorrect recipient.
  • Computing devices containing personal data being lost or stolen.
  • Paper files containing personal data being lost or stolen.
  • Alteration of personal data without permission, and
  • Loss of availability of personal data.
• A personal data breach can be broadly defined as a security incident that has affected the confidentiality, integrity or availability of personal data.
• There will be a personal data breach whenever any personal data is accidentally lost, destroyed, corrupted or disclosed or if someone accesses the data or passes it on without proper authorisation or if the data is made unavailable and this unavailability has a significant negative effect on individuals.

  2. Who is responsible for managing personal data breaches 

• The Parish Clerk is responsible for the ongoing compliance monitoring of this and other policies that are designed to achieve compliance with the Data Protection Legislation. (“the person responsible for data protection”).
• No user within the organisation shall deviate from this policy without written authorisation from the person responsible for data protection.
  3.  Time Limits
• Not all personal data breaches are reportable to the Information Commissioner’s Office (“ICO”) but those that are must be reported within 72 hours of ‘becoming aware’ of a breach.
• The 72-hour time frame is irrespective of bank holidays or weekends.
• Users who suspect there has been a breach must notify in writing the person responsible for data protection within 1 hour of becoming aware of the suspected breach.

The full policy is available to view and download.