Personal-Data Breaches and ICO Notification

Lesson plan

Level

Beginner

Time

About 60 minutes; the steps below add up to 60

Learners decide what they would want to know after sending friends’ numbers to the wrong group chat, and whether a breach needs an attacker, before the legal terms appear. Predictions then precede ransomware without theft, Dev’s next ten minutes, when awareness began, what to weigh, the two audiences and the health-data variation; checks follow a blocked phishing email, a recalled email, a processor’s timing and recording. The habit to build: report at once, assess the risk to people, and apply each threshold separately. This lesson is educational, not legal advice.

Objectives

• Tell a personal data breach from other security incidents
• Recognise breaches of confidentiality, integrity and availability
• Work through discovery, fact-finding and risk assessment
• Apply the separate thresholds for telling the ICO and telling affected people
• Explain why every breach is recorded

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Data Protection lesson first.
• Draw the two thresholds side by side on the board: “unless unlikely” for the ICO, “likely high” for people.
• The lesson takes about 60 minutes. To teach it in two parts, stop after “Assess risk to people”; the second part opens with “Decide notification and communication”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Tell a personal data breach from other security incidents
   • Recognise breaches of confidentiality, integrity and availability
   • Work through discovery, fact-finding and risk assessment
   • Apply the separate thresholds for telling the ICO and telling affected people
   • Explain why every breach is recorded

   Purpose: Learners decide what they would want to know after sending friends’ numbers to the wrong group chat, and whether a breach needs an attacker, before the legal terms appear. Predictions then precede ransomware without theft, Dev’s next ten minutes, when awareness began, what to weigh, the two audiences and the health-data variation; checks follow a blocked phishing email, a recalled email, a processor’s timing and recording. The habit to build: report at once, assess the risk to people, and apply each threshold separately. This lesson is educational, not legal advice.

2. 1. The wrong group chat Think 5 min

   Purpose: Raise breach questions from an everyday mistake.

   Ask

   • What would you want to know?
   • Does a breach need an attacker?

   Responses to expect

   • The contents and the audience come first.
   • On screen in turns: the opening question, its answer; then the question on whether a breach needs an attacker, and its answer.

   Discussion pause: Collect questions and sort them into facts and harms before revealing.

   In the lesson window

   • Think it through: You send a message containing friends’ phone numbers to the wrong group chat, then delete it a minute later. What would you want to know before deciding who to tell?
   • Think it through: Does a mistake have to involve an attacker to count as a data breach?

3. 2. Security incidents and personal-data breaches Explain 4 min

   Purpose: Separate security incidents from personal data breaches.

   Ask

   • Is a blocked phishing email a breach?

   Responses to expect

   • Some say yes.
   • On screen in turns: the opening; then the check question on a blocked phishing email, and its answer; why the distinction matters.

   In the lesson window

   • Check your understanding: A phishing email is blocked before anyone opens it, and no data is touched. Is it a personal data breach?

4. 3. What counts as a personal data breach? Predict 5 min

   Purpose: Show confidentiality, integrity and availability breaches.

   Ask

   • Is ransomware without theft a breach?

   Responses to expect

   • Availability breaches surprise many.
   • On screen in turns: the opening; then breaches by CIA property, starting with confidentiality; integrity; availability; the question on ransomware with no theft, and its answer; blocked attacks, and the absence of evidence.

   Misconceptions to challenge

   • A learner may believe: “No attacker means no breach.” Respond: Accidents count too.

   In the lesson window

   • Think it through: Ransomware encrypts the only usable copy of a learner database, but there is no sign that anything was copied out. Could it still be a personal data breach?

5. 4. Worked breach assessment Predict 3 min

   Purpose: Set up the fictional incident and its facts.

   Ask

   • What does Dev do now?

   Responses to expect

   • Report it at once.
   • On screen in turns: the opening; then the facts that will matter, starting with the register; the recipient; the attachment; the question on the next ten minutes, and its answer; five steps to follow.

   In the lesson window

   • Think it through: You are Dev. You have just noticed the email went to the wrong Sam. What do you do in the next ten minutes?

6. 5. Discovery and containment Predict 5 min

   Purpose: Explain prompt reporting and containment, and what containment does not prove.

   Ask

   • Does a recall prove anything?

   Responses to expect

   • Many treat a recall as proof.
   • On screen in turns: the opening; then the check question on a recalled email, and its answer; discovery and containment in the example.

   In the lesson window

   • Check your understanding: An email is recalled successfully. Does that prove the attachment was never read?

7. 6. Fact-finding and awareness Predict 5 min

   Purpose: Establish the facts and the moment of awareness.

   Ask

   • When did the organisation become aware?

   Responses to expect

   • Learners often wait for the investigation to end.
   • On screen in turns: the opening; then record the facts and timing; the question on when the organisation became aware, and its answer; fact-finding in the example.

   In the lesson window

   • Think it through: When did the organisation become aware of the breach: when Dev checked his sent items, or when the investigation finished?

8. 7. Assess risk to people Predict 6 min

   Purpose: Assess risk to people’s rights and freedoms in the example.

   Ask

   • What four things would you weigh?

   Responses to expect

   • The organisation’s reputation is a common wrong focus.
   • On screen in turns: the opening; then a trusted recipient or an unknown one; the question on what to weigh, and its answer; the manager weighs four things, starting with what was sent; who received it; what has been done; what could happen to the learners; the conclusion: harm is unlikely.

   In the lesson window

   • Think it through: Before reading the manager’s view: what four things would you weigh to judge the risk to the 24 learners?

9. 8. Decide notification and communication Predict 8 min

   Purpose: Apply the ICO and individual thresholds, the processor’s duty and the Article 34 qualifications.

   Ask

   • Who are the two audiences?
   • When must a processor tell the controller?

   Responses to expect

   • The two thresholds are often merged.
   • Diagram: reveal the ICO decision first, then the affected people; ask for each threshold before it appears.
   • On screen in turns: the opening question, its answer; then the two decisions, starting with the ICO; the affected people, and what both paths share; internal reporting; ICO notification: Article 33; telling affected people: Article 34; when people need not be told; other reporting duties; the check question on a processor’s timing, and its answer; the two decisions in the example, starting with the ICO; the learners.

   Misconceptions to challenge

   • A learner may believe: “Every personal data breach must be reported to the ICO.” Respond: Only unless it is unlikely to result in a risk; every breach is recorded.
   • A learner may believe: “If we tell the ICO, we must also tell everyone affected.” Respond: That has a separate, higher threshold.

   If the explanation does not land: Use a ladder: record every breach; tell the ICO from “a risk” up; tell people from “a high risk” up.

   In the lesson window

   • Think it through: There are two separate decisions about telling people. Who are the two audiences, and would you expect them to have the same threshold?
   • Check your understanding: A processor discovers a breach on Monday. When must it tell the controller?

10. 9. Documentation and review Predict 5 min

    Purpose: Record every breach with reasons, review causes, and work the health-data variation.

    Ask

    • Must the breach still be recorded?
    • What if What changes if health data went to an unknown address?

    Responses to expect

    • Most see that both decisions flip.
    • On screen in turns: the opening; then reviewing the cause; the check question on recording anyway, and its answer; recording in the example; the result; the question on a health column, and its answer; changing one fact, starting with the kind of information; the recipient; telling the ICO; telling the learners; the same mistake, a different outcome.

    Misconceptions to challenge

    • A learner may believe: “We have 72 hours before we need to act.” Respond: Without undue delay; 72 hours is an outer limit.

    To go further

    • What would you put in a phased report to the ICO if the facts were still incomplete at 72 hours?

    In the lesson window

    • Check your understanding: The organisation decides the ICO need not be told. Must it still record the breach?
    • Think it through: Now suppose the register also listed learners’ health conditions, and went to an unknown address that does not answer. Predict both decisions.

11. 10. The thresholds side by side Explain 4 min

    Purpose: Compare the four decisions, their thresholds and their timing.

    Ask

    • Which decision has no 72-hour allowance?

    Responses to expect

    • The processor telling the controller.
    • On screen in turns: the opening; then four decisions, with thresholds and timing held back; the threshold for each; the timing; other duties alongside these; report first, judge later.

    Discussion pause: The threshold and timing columns are held back: let the class fill each in from memory before revealing them.

12. 11. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • Thursday tests timing; the laptop tests the encryption qualification; the colleague tests separate thresholds.
    • On screen in turns: the opening; then the question on waiting until Thursday, and its answer; the question on an encrypted laptop, and its answer; the question on telling everyone because the ICO was told, and its answer.

    In the lesson window

    • Apply it: A manager says, “We have 72 hours, so let’s wait until Thursday and see.” What is wrong?
    • Apply it: A laptop holding customers’ health records is lost, but strong encryption was definitely applied to it. Must the customers be told?
    • Apply it: A colleague says that because the ICO has been told, every affected person must be told too. What is the best reply?

13. 12. Check your understanding Check 4 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The threshold questions link to the notification step.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

14. 13. What to remember Consolidate 2 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: the two notification thresholds.

    Responses to expect

    • ICO unless unlikely to result in a risk; people where likely high risk.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

15. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Incident first; breach if personal data is affected.
    • Report at once; awareness starts the clock.
    • Risk to people, not to the organisation.
    • Two thresholds, two audiences.
    • Record every breach, with reasons.

Consolidation

• Incident first; breach if personal data is affected.
• Report at once; awareness starts the clock.
• Risk to people, not to the organisation.
• Two thresholds, two audiences.
• Record every breach, with reasons.