In short: if personal data is lost, exposed or accessed without authority, we act at once to contain it,
tell the affected facility without undue delay, and help it notify the regulator and the people affected, as the law requires.
1. What counts as an incident
- Unauthorised access to, or disclosure of, personal data, by an outsider or by a user going beyond their role.
- Loss or theft of a device, printout or export containing personal data.
- Data altered or destroyed by mistake or maliciously.
- A security weakness that could have led to any of the above.
2. How to report one
Facility staff: report immediately to your supervisor or your facility's data protection lead. Don't try to investigate on your own, and don't delete anything. Anyone else: email [email protected].
3. Our response
| Step | What happens |
|---|---|
| 1. Contain | Stop the exposure: revoke access, deactivate accounts, block traffic or take affected parts of the system offline. |
| 2. Assess | Establish what data, which people and which facilities are affected, using the audit trail and server logs. |
| 3. Notify | Inform the affected facility without undue delay, with the facts known so far, and keep it updated. |
| 4. Report | Support the facility, as data controller, to notify the Personal Data Protection Office and, where there is a real risk of harm, the people affected, within the time the law requires. |
| 5. Recover | Restore systems and data, and confirm that nothing remains exposed. |
| 6. Learn | Find the root cause, fix it, and record the lessons so the same thing cannot happen again. |
4. Inside GomoClinic
Facilities can log and investigate incidents, including data incidents, in the Quality & Compliance module's incident reporting, and use the audit trail to see exactly which records were changed, by whom and when.