{"text_format":"1","workbook":"xlsx","n_sheets":12,"sheets":["Introduction","Dashboard","Master sheet","Tables & graphs","Lookup","1. Accountability","2. Policies and procedures","3. Training ","4. 3rd party arrangements","5. Ident, assessment & log","6. Reporting processes","7. Feedback & lessons learned"],"not_rendered":{"charts":12,"images":1,"macros":1,"external_links":0,"defined_names":8,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Introduction","index":0,"n_rows":6,"n_cols":2,"rows_kept":6,"cut":false,"hidden":false,"merged":[[5,1,42,15],[4,1,4,15]]}
[]
[]
[]
[]
[null,"Personal Data Breach Management and Reporting Toolkit Tracker"]
[null,"\nYou can use this Tracker to record and track your actions once you have read the toolkit. \n\nThe first tab is called ‘Dashboard’. The dashboard will update automatically when you fill in the spreadsheet.\n\nThe next tab is called ‘Master Sheet’. This shows the toolkit and records all your responses in one place.\n\nWe have suggested some columns to help you to build your own action plan and improve your compliance. However, as the spreadsheet contains formula we would not recommend altering any of the existing columns. If you do make changes, you may impact the dashboard, master sheet or general functionality. Please note that we cannot offer support for maintaining the spreadsheet.\n\nKey phrases:\n\nCurrent status – This refers to whether you are ‘fully meeting our expectation’, ‘partially meeting our expectation’, or ‘not meeting our expectation’. You can also record the status as ‘not applicable’ to your organisation. You can choose the status from a drop-down list.\n\nReasons for status – You can record the reasons why you have chosen the ‘Current status’ for this expectation.\n\nActions – You can describe what you need to do next to meet the expectation.\n\nAction Owner(s) – You can specify who is responsible for the action.\n\nAction Status – You can choose what stage the action is at from a drop-down list. \n\nDue Date – You can record when you expect to complete the action.\n\n\n\nThe Data Protection Audit Framework, including the Tracker, is available under the terms of the Open Government Licence v3.0."]

{"sheet":"Dashboard","index":1,"n_rows":0,"n_cols":0,"rows_kept":0,"cut":false,"hidden":false,"merged":[]}

{"sheet":"Master sheet","index":2,"n_rows":76,"n_cols":16,"rows_kept":76,"cut":false,"hidden":false,"merged":[[66,1,75,1],[66,2,75,2],[66,0,75,0],[30,0,52,0],[53,1,60,1],[53,2,60,2],[61,1,65,1],[61,2,65,2],[53,0,65,0],[30,1,33,1],[30,2,33,2],[34,1,44,1],[34,2,44,2],[45,1,52,1],[45,2,52,2],[22,1,25,1],[22,2,25,2],[26,1,29,1],[26,2,29,2],[22,0,29,0],[12,1,18,1],[12,2,18,2],[19,1,21,1],[19,2,21,2],[12,0,21,0],[0,0,0,3],[2,1,5,1],[2,2,5,2],[2,0,5,0],[6,1,11,1],[6,2,11,2],[6,0,11,0]]}
["Personal Data Breach Management and Reporting Tracker\nMaster Sheet"]
["Category","Number","Our expectations","Reference","Ways to meet our expectations ","Current Status","Reasons for Status","Action(s)","Action owner","Action Status","Completion date\n(DD/MM/YYYY)",{"$f":"IF(ISBLANK('1. Accountability'!K1),\"\",'1. Accountability'!K1)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!L1),\"\",'1. Accountability'!L1)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!M1),\"\",'1. Accountability'!M1)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!N1),\"\",'1. Accountability'!N1)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!O1),\"\",'1. Accountability'!O1)","v":""}]
["Accountability",1.1000000000000001,"Nominated staff are assigned to oversee and make decisions on personal data breaches. They should be senior and experienced enough to make informed decisions.","1.1.1","\tAllocate ultimate responsibility for assessing and reporting personal data breaches at board or senior management level.",{"$f":"IF(ISBLANK('1. Accountability'!E2),\"\",'1. Accountability'!E2)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!F2),\"\",'1. Accountability'!F2)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!G2),\"\",'1. Accountability'!G2)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!H2),\"\",'1. Accountability'!H2)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!I2),\"\",'1. Accountability'!I2)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!J2),\"\",'1. Accountability'!J2)","v":""}]
[{"$f":"A3","v":"Accountability"},1.1000000000000001,"Nominated staff are assigned to oversee and make decisions on personal data breaches. They should be senior and experienced enough to make informed decisions.","1.1.2","\tAllocate day-to-day management and decision-making responsibilities to oversee your response to personal data breaches, including decisions on whether to report and escalate, where appropriate.",{"$f":"IF(ISBLANK('1. Accountability'!E3),\"\",'1. Accountability'!E3)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!F3),\"\",'1. Accountability'!F3)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!G3),\"\",'1. Accountability'!G3)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!H3),\"\",'1. Accountability'!H3)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!I3),\"\",'1. Accountability'!I3)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!J3),\"\",'1. Accountability'!J3)","v":""}]
["Accountability",1.1000000000000001,"Nominated staff are assigned to oversee and make decisions on personal data breaches. They should be senior and experienced enough to make informed decisions.","1.1.3","\tDesignate a person or team to document the progress and actions taken in response to personal data breaches. ",{"$f":"IF(ISBLANK('1. Accountability'!E4),\"\",'1. Accountability'!E4)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!F4),\"\",'1. Accountability'!F4)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!G4),\"\",'1. Accountability'!G4)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!H4),\"\",'1. Accountability'!H4)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!I4),\"\",'1. Accountability'!I4)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!J4),\"\",'1. Accountability'!J4)","v":""}]
["Accountability",1.1000000000000001,"Nominated staff are assigned to oversee and make decisions on personal data breaches. They should be senior and experienced enough to make informed decisions.","1.1.4","\tReflect these responsibilities in the relevant job descriptions.",{"$f":"IF(ISBLANK('1. Accountability'!E5),\"\",'1. Accountability'!E5)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!F5),\"\",'1. Accountability'!F5)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!G5),\"\",'1. Accountability'!G5)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!H5),\"\",'1. Accountability'!H5)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!I5),\"\",'1. Accountability'!I5)","v":""},{"$f":"IF(ISBLANK('1. Accountability'!J5),\"\",'1. Accountability'!J5)","v":""}]
["Policies and Procedures",2.1,"There is a documented approach to managing security incidents resulting in a personal data breach that is regularly reviewed to allow the organisation to plan effectively.","2.1.1","\tHave a breach notification policy with clear guidance for staff to follow in the event of a personal data breach.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E2),\"\",'2. Policies and procedures'!E2)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F2),\"\",'2. Policies and procedures'!F2)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G2),\"\",'2. Policies and procedures'!G2)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H2),\"\",'2. Policies and procedures'!H2)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I2),\"\",'2. Policies and procedures'!I2)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J2),\"\",'2. Policies and procedures'!J2)","v":""}]
[{"$f":"A7","v":"Policies and Procedures"},2.1,"There is a documented approach to managing security incidents resulting in a personal data breach that is regularly reviewed to allow the organisation to plan effectively.","2.1.2","\tPut procedures in place for breach management and incident response teams to follow in the event of a personal data breach, including escalation, where appropriate.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E3),\"\",'2. Policies and procedures'!E3)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F3),\"\",'2. Policies and procedures'!F3)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G3),\"\",'2. Policies and procedures'!G3)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H3),\"\",'2. Policies and procedures'!H3)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I3),\"\",'2. Policies and procedures'!I3)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J3),\"\",'2. Policies and procedures'!J3)","v":""}]
["Policies and Procedures",2.1,"There is a documented approach to managing security incidents resulting in a personal data breach that is regularly reviewed to allow the organisation to plan effectively.","2.1.3","\tMake policies and procedures readily available to all staff (eg intranet, starter packs).  ",{"$f":"IF(ISBLANK('2. Policies and procedures'!E4),\"\",'2. Policies and procedures'!E4)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F4),\"\",'2. Policies and procedures'!F4)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G4),\"\",'2. Policies and procedures'!G4)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H4),\"\",'2. Policies and procedures'!H4)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I4),\"\",'2. Policies and procedures'!I4)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J4),\"\",'2. Policies and procedures'!J4)","v":""}]
["Policies and Procedures",2.1,"There is a documented approach to managing security incidents resulting in a personal data breach that is regularly reviewed to allow the organisation to plan effectively.","2.1.4","\tRegularly review policies and procedures, including recording the review dates, versions and change log.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E5),\"\",'2. Policies and procedures'!E5)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F5),\"\",'2. Policies and procedures'!F5)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G5),\"\",'2. Policies and procedures'!G5)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H5),\"\",'2. Policies and procedures'!H5)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I5),\"\",'2. Policies and procedures'!I5)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J5),\"\",'2. Policies and procedures'!J5)","v":""}]
["Policies and Procedures",2.1,"There is a documented approach to managing security incidents resulting in a personal data breach that is regularly reviewed to allow the organisation to plan effectively.","2.1.5","\tReview policies and procedures in light of any personal data breaches or near misses. ",{"$f":"IF(ISBLANK('2. Policies and procedures'!E6),\"\",'2. Policies and procedures'!E6)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F6),\"\",'2. Policies and procedures'!F6)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G6),\"\",'2. Policies and procedures'!G6)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H6),\"\",'2. Policies and procedures'!H6)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I6),\"\",'2. Policies and procedures'!I6)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J6),\"\",'2. Policies and procedures'!J6)","v":""}]
["Policies and Procedures",2.1,"There is a documented approach to managing security incidents resulting in a personal data breach that is regularly reviewed to allow the organisation to plan effectively.","2.1.6","\tDocument within policies and procedures, a set of criteria to assess both the severity of the personal data breach and the likely effect on people's rights and freedoms. Include references to guidance (eg ICO guidance) and provide particular guidance on how to assess a 'high risk' to affected people.",{"$f":"IF(ISBLANK('2. Policies and procedures'!E7),\"\",'2. Policies and procedures'!E7)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!F7),\"\",'2. Policies and procedures'!F7)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!G7),\"\",'2. Policies and procedures'!G7)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!H7),\"\",'2. Policies and procedures'!H7)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!I7),\"\",'2. Policies and procedures'!I7)","v":""},{"$f":"IF(ISBLANK('2. Policies and procedures'!J7),\"\",'2. Policies and procedures'!J7)","v":""}]
["Training",3.1,"Staff with responsibility for processing personal information are able to recognise and escalate personal data breaches.","3.1.1","\tTrain staff to recognise and report personal data breaches before they work with personal information.",{"$f":"IF(ISBLANK('3. Training '!E2),\"\",'3. Training '!E2)","v":""},{"$f":"IF(ISBLANK('3. Training '!F2),\"\",'3. Training '!F2)","v":""},{"$f":"IF(ISBLANK('3. Training '!G2),\"\",'3. Training '!G2)","v":""},{"$f":"IF(ISBLANK('3. Training '!H2),\"\",'3. Training '!H2)","v":""},{"$f":"IF(ISBLANK('3. Training '!I2),\"\",'3. Training '!I2)","v":""},{"$f":"IF(ISBLANK('3. Training '!J2),\"\",'3. Training '!J2)","v":""}]
[{"$f":"A13","v":"Training"},{"$f":"B13","v":3.1},"Staff with responsibility for processing personal information are able to recognise and escalate personal data breaches.","3.1.2","\tProvide periodic staff refresher training to recognise and escalate personal data breaches.",{"$f":"IF(ISBLANK('3. Training '!E3),\"\",'3. Training '!E3)","v":""},{"$f":"IF(ISBLANK('3. Training '!F3),\"\",'3. Training '!F3)","v":""},{"$f":"IF(ISBLANK('3. Training '!G3),\"\",'3. Training '!G3)","v":""},{"$f":"IF(ISBLANK('3. Training '!H3),\"\",'3. Training '!H3)","v":""},{"$f":"IF(ISBLANK('3. Training '!I3),\"\",'3. Training '!I3)","v":""},{"$f":"IF(ISBLANK('3. Training '!J3),\"\",'3. Training '!J3)","v":""}]
["Training",3.1,"Staff with responsibility for processing personal information are able to recognise and escalate personal data breaches.","3.1.3","\tReinforce training with reminders (eg posters, newsletter sections, emails and intranet bulletins).",{"$f":"IF(ISBLANK('3. Training '!E4),\"\",'3. Training '!E4)","v":""},{"$f":"IF(ISBLANK('3. Training '!F4),\"\",'3. Training '!F4)","v":""},{"$f":"IF(ISBLANK('3. Training '!G4),\"\",'3. Training '!G4)","v":""},{"$f":"IF(ISBLANK('3. Training '!H4),\"\",'3. Training '!H4)","v":""},{"$f":"IF(ISBLANK('3. Training '!I4),\"\",'3. Training '!I4)","v":""},{"$f":"IF(ISBLANK('3. Training '!J4),\"\",'3. Training '!J4)","v":""}]
["Training",3.1,"Staff with responsibility for processing personal information are able to recognise and escalate personal data breaches.","3.1.4","\tIncorporate anonymised examples of personal data breaches into data protection training, particularly if training is tailored to specific business areas.",{"$f":"IF(ISBLANK('3. Training '!E5),\"\",'3. Training '!E5)","v":""},{"$f":"IF(ISBLANK('3. Training '!F5),\"\",'3. Training '!F5)","v":""},{"$f":"IF(ISBLANK('3. Training '!G5),\"\",'3. Training '!G5)","v":""},{"$f":"IF(ISBLANK('3. Training '!H5),\"\",'3. Training '!H5)","v":""},{"$f":"IF(ISBLANK('3. Training '!I5),\"\",'3. Training '!I5)","v":""},{"$f":"IF(ISBLANK('3. Training '!J5),\"\",'3. Training '!J5)","v":""}]
["Training",3.1,"Staff with responsibility for processing personal information are able to recognise and escalate personal data breaches.","3.1.5","\tInclude in the training an adequate explanation of how each personal data breach occurred to raise awareness and mitigate against future occurrences of each type of incident.",{"$f":"IF(ISBLANK('3. Training '!E6),\"\",'3. Training '!E6)","v":""},{"$f":"IF(ISBLANK('3. Training '!F6),\"\",'3. Training '!F6)","v":""},{"$f":"IF(ISBLANK('3. Training '!G6),\"\",'3. Training '!G6)","v":""},{"$f":"IF(ISBLANK('3. Training '!H6),\"\",'3. Training '!H6)","v":""},{"$f":"IF(ISBLANK('3. Training '!I6),\"\",'3. Training '!I6)","v":""},{"$f":"IF(ISBLANK('3. Training '!J6),\"\",'3. Training '!J6)","v":""}]
["Training",3.1,"Staff with responsibility for processing personal information are able to recognise and escalate personal data breaches.","3.1.6","\tProvide written, easily accessible staff guidance on recognising and handling personal data breaches.",{"$f":"IF(ISBLANK('3. Training '!E7),\"\",'3. Training '!E7)","v":""},{"$f":"IF(ISBLANK('3. Training '!F7),\"\",'3. Training '!F7)","v":""},{"$f":"IF(ISBLANK('3. Training '!G7),\"\",'3. Training '!G7)","v":""},{"$f":"IF(ISBLANK('3. Training '!H7),\"\",'3. Training '!H7)","v":""},{"$f":"IF(ISBLANK('3. Training '!I7),\"\",'3. Training '!I7)","v":""},{"$f":"IF(ISBLANK('3. Training '!J7),\"\",'3. Training '!J7)","v":""}]
["Training",3.1,"Staff with responsibility for processing personal information are able to recognise and escalate personal data breaches.","3.1.7","\tImplement a culture of trust so employees feel able to report near misses.",{"$f":"IF(ISBLANK('3. Training '!E8),\"\",'3. Training '!E8)","v":""},{"$f":"IF(ISBLANK('3. Training '!F8),\"\",'3. Training '!F8)","v":""},{"$f":"IF(ISBLANK('3. Training '!G8),\"\",'3. Training '!G8)","v":""},{"$f":"IF(ISBLANK('3. Training '!H8),\"\",'3. Training '!H8)","v":""},{"$f":"IF(ISBLANK('3. Training '!I8),\"\",'3. Training '!I8)","v":""},{"$f":"IF(ISBLANK('3. Training '!J8),\"\",'3. Training '!J8)","v":""}]
["Training",3.2,"Decision-makers are equipped to make informed decisions about personal data breaches.","3.2.1","\tProvide specialised personal data breach training to decision makers so they are able to effectively carry out this aspect of their role.",{"$f":"IF(ISBLANK('3. Training '!E9),\"\",'3. Training '!E9)","v":""},{"$f":"IF(ISBLANK('3. Training '!F9),\"\",'3. Training '!F9)","v":""},{"$f":"IF(ISBLANK('3. Training '!G9),\"\",'3. Training '!G9)","v":""},{"$f":"IF(ISBLANK('3. Training '!H9),\"\",'3. Training '!H9)","v":""},{"$f":"IF(ISBLANK('3. Training '!I9),\"\",'3. Training '!I9)","v":""},{"$f":"IF(ISBLANK('3. Training '!J9),\"\",'3. Training '!J9)","v":""}]
[{"$f":"A20","v":"Training"},3.2,"Decision-makers are equipped to make informed decisions about personal data breaches.","3.2.2","\tProvide supplementary guidance to personal data breach decision makers (eg security incident flowcharts).",{"$f":"IF(ISBLANK('3. Training '!E10),\"\",'3. Training '!E10)","v":""},{"$f":"IF(ISBLANK('3. Training '!F10),\"\",'3. Training '!F10)","v":""},{"$f":"IF(ISBLANK('3. Training '!G10),\"\",'3. Training '!G10)","v":""},{"$f":"IF(ISBLANK('3. Training '!H10),\"\",'3. Training '!H10)","v":""},{"$f":"IF(ISBLANK('3. Training '!I10),\"\",'3. Training '!I10)","v":""},{"$f":"IF(ISBLANK('3. Training '!J10),\"\",'3. Training '!J10)","v":""}]
["Training",3.2,"Decision-makers are equipped to make informed decisions about personal data breaches.","3.2.3","\tRegularly refresh specialised training. ",{"$f":"IF(ISBLANK('3. Training '!E11),\"\",'3. Training '!E11)","v":""},{"$f":"IF(ISBLANK('3. Training '!F11),\"\",'3. Training '!F11)","v":""},{"$f":"IF(ISBLANK('3. Training '!G11),\"\",'3. Training '!G11)","v":""},{"$f":"IF(ISBLANK('3. Training '!H11),\"\",'3. Training '!H11)","v":""},{"$f":"IF(ISBLANK('3. Training '!I11),\"\",'3. Training '!I11)","v":""},{"$f":"IF(ISBLANK('3. Training '!J11),\"\",'3. Training '!J11)","v":""}]
["Third party arrangements",4.0999999999999996,"Arrangements are in place with joint controllers in the event of a personal data breach.","4.1.1","\tIdentify any controllers who you jointly process information with. ",{"$f":"IF(ISBLANK('4. 3rd party arrangements'!E2),\"\",'4. 3rd party arrangements'!E2)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!F2),\"\",'4. 3rd party arrangements'!F2)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!G2),\"\",'4. 3rd party arrangements'!G2)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!H2),\"\",'4. 3rd party arrangements'!H2)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!I2),\"\",'4. 3rd party arrangements'!I2)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!J2),\"\",'4. 3rd party arrangements'!J2)","v":""}]
[{"$f":"A23","v":"Third party arrangements"},{"$f":"B23","v":4.0999999999999996},"Arrangements are in place with joint controllers in the event of a personal data breach.","4.1.2","\tDetermine with joint controllers your respective responsibilities for handling personal data breaches.",{"$f":"IF(ISBLANK('4. 3rd party arrangements'!E3),\"\",'4. 3rd party arrangements'!E3)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!F3),\"\",'4. 3rd party arrangements'!F3)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!G3),\"\",'4. 3rd party arrangements'!G3)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!H3),\"\",'4. 3rd party arrangements'!H3)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!I3),\"\",'4. 3rd party arrangements'!I3)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!J3),\"\",'4. 3rd party arrangements'!J3)","v":""}]
["Third party arrangements",4.0999999999999996,"Arrangements are in place with joint controllers in the event of a personal data breach.","4.1.3","\tAgree communication channels between the parties in the event of a personal data breach, including nominated points of contact.",{"$f":"IF(ISBLANK('4. 3rd party arrangements'!E4),\"\",'4. 3rd party arrangements'!E4)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!F4),\"\",'4. 3rd party arrangements'!F4)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!G4),\"\",'4. 3rd party arrangements'!G4)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!H4),\"\",'4. 3rd party arrangements'!H4)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!I4),\"\",'4. 3rd party arrangements'!I4)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!J4),\"\",'4. 3rd party arrangements'!J4)","v":""}]
["Third party arrangements",4.0999999999999996,"Arrangements are in place with joint controllers in the event of a personal data breach.","4.1.4","\tTest breach communication channels and procedures with joint controllers.",{"$f":"IF(ISBLANK('4. 3rd party arrangements'!E5),\"\",'4. 3rd party arrangements'!E5)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!F5),\"\",'4. 3rd party arrangements'!F5)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!G5),\"\",'4. 3rd party arrangements'!G5)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!H5),\"\",'4. 3rd party arrangements'!H5)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!I5),\"\",'4. 3rd party arrangements'!I5)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!J5),\"\",'4. 3rd party arrangements'!J5)","v":""}]
["Third party arrangements",4.2,"Contracts are in place between the controller and any processors working on their behalf that reflect the processor's obligations in the event of a personal data breach.","4.2.1","\tPut in place contractual agreements with processors that specify how to meet the requirements of article 33 of the UK GDPR and each parties' responsibilities if a personal data breach occurs.",{"$f":"IF(ISBLANK('4. 3rd party arrangements'!E6),\"\",'4. 3rd party arrangements'!E6)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!F6),\"\",'4. 3rd party arrangements'!F6)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!G6),\"\",'4. 3rd party arrangements'!G6)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!H6),\"\",'4. 3rd party arrangements'!H6)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!I6),\"\",'4. 3rd party arrangements'!I6)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!J6),\"\",'4. 3rd party arrangements'!J6)","v":""}]
[{"$f":"A27","v":"Third party arrangements"},4.2,"Contracts are in place between the controller and any processors working on their behalf that reflect the processor's obligations in the event of a personal data breach.","4.2.2","\tInclude any agreed arrangements for the processor to report a personal data breach on your behalf.",{"$f":"IF(ISBLANK('4. 3rd party arrangements'!E7),\"\",'4. 3rd party arrangements'!E7)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!F7),\"\",'4. 3rd party arrangements'!F7)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!G7),\"\",'4. 3rd party arrangements'!G7)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!H7),\"\",'4. 3rd party arrangements'!H7)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!I7),\"\",'4. 3rd party arrangements'!I7)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!J7),\"\",'4. 3rd party arrangements'!J7)","v":""}]
["Third party arrangements",4.2,"Contracts are in place between the controller and any processors working on their behalf that reflect the processor's obligations in the event of a personal data breach.","4.2.3","\tAgree and document timescales for processors to report suspected personal data breaches to you. ",{"$f":"IF(ISBLANK('4. 3rd party arrangements'!E8),\"\",'4. 3rd party arrangements'!E8)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!F8),\"\",'4. 3rd party arrangements'!F8)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!G8),\"\",'4. 3rd party arrangements'!G8)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!H8),\"\",'4. 3rd party arrangements'!H8)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!I8),\"\",'4. 3rd party arrangements'!I8)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!J8),\"\",'4. 3rd party arrangements'!J8)","v":""}]
["Third party arrangements",4.2,"Contracts are in place between the controller and any processors working on their behalf that reflect the processor's obligations in the event of a personal data breach.","4.2.4","\tAgree communication channels between parties in the event of a personal data breach and nominated points of contact.",{"$f":"IF(ISBLANK('4. 3rd party arrangements'!E9),\"\",'4. 3rd party arrangements'!E9)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!F9),\"\",'4. 3rd party arrangements'!F9)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!G9),\"\",'4. 3rd party arrangements'!G9)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!H9),\"\",'4. 3rd party arrangements'!H9)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!I9),\"\",'4. 3rd party arrangements'!I9)","v":""},{"$f":"IF(ISBLANK('4. 3rd party arrangements'!J9),\"\",'4. 3rd party arrangements'!J9)","v":""}]
["Breach identification, assessment and logging",5.0999999999999996,"Measures are in place to prevent and detect personal data breaches.","5.1.1","Put in place appropriate organisational measures to prevent personal data breaches, for example: \n- \tinformation security policies and procedures; \n- \trisk assessments; \n- \tinternal audits; \n- \tfraud detection reviews; or\n- \tthird-party notification procedures.",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E2),\"\",'5. Ident, assessment & log'!E2)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F2),\"\",'5. Ident, assessment & log'!F2)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G2),\"\",'5. Ident, assessment & log'!G2)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H2),\"\",'5. Ident, assessment & log'!H2)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I2),\"\",'5. Ident, assessment & log'!I2)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J2),\"\",'5. Ident, assessment & log'!J2)","v":""}]
[{"$f":"A31","v":"Breach identification, assessment and logging"},{"$f":"B31","v":5.0999999999999996},"Measures are in place to prevent and detect personal data breaches.","5.1.2","Put in place appropriate technical measures to promptly detect personal data breaches, for example: \n- \tdata flow and log analysers;\n- \tintrusion detection systems and intrusion prevention systems or firewalls that can alert to and identify actual personal data breaches; \n- \tdata leakage control; and \n- \taccess logging.",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E3),\"\",'5. Ident, assessment & log'!E3)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F3),\"\",'5. Ident, assessment & log'!F3)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G3),\"\",'5. Ident, assessment & log'!G3)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H3),\"\",'5. Ident, assessment & log'!H3)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I3),\"\",'5. Ident, assessment & log'!I3)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J3),\"\",'5. Ident, assessment & log'!J3)","v":""}]
["Breach identification, assessment and logging",5.0999999999999996,"Measures are in place to prevent and detect personal data breaches.","5.1.3","\tEnsure there is an effective process to identify, investigate and respond to any suspected offences under section 170 DPA 18. ",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E4),\"\",'5. Ident, assessment & log'!E4)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F4),\"\",'5. Ident, assessment & log'!F4)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G4),\"\",'5. Ident, assessment & log'!G4)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H4),\"\",'5. Ident, assessment & log'!H4)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I4),\"\",'5. Ident, assessment & log'!I4)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J4),\"\",'5. Ident, assessment & log'!J4)","v":""}]
["Breach identification, assessment and logging",5.0999999999999996,"Measures are in place to prevent and detect personal data breaches.","5.1.4","\tEnsure there is a threshold for a reasonable level of certainty\" that a personal data breach has occurred.",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E5),\"\",'5. Ident, assessment & log'!E5)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F5),\"\",'5. Ident, assessment & log'!F5)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G5),\"\",'5. Ident, assessment & log'!G5)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H5),\"\",'5. Ident, assessment & log'!H5)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I5),\"\",'5. Ident, assessment & log'!I5)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J5),\"\",'5. Ident, assessment & log'!J5)","v":""}]
["Breach identification, assessment and logging",5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.1","\tRecord the type of personal and special category information held.",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E6),\"\",'5. Ident, assessment & log'!E6)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F6),\"\",'5. Ident, assessment & log'!F6)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G6),\"\",'5. Ident, assessment & log'!G6)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H6),\"\",'5. Ident, assessment & log'!H6)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I6),\"\",'5. Ident, assessment & log'!I6)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J6),\"\",'5. Ident, assessment & log'!J6)","v":""}]
["Breach identification, assessment and logging",{"$f":"B35","v":5.2},{"$f":"C35","v":"Measures are in place to assess the severity of personal data breaches."},"5.2.2","\tDocument and put in place criteria to assess the severity of the personal data breach and the likely effect on people's rights and freedoms",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E7),\"\",'5. Ident, assessment & log'!E7)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F7),\"\",'5. Ident, assessment & log'!F7)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G7),\"\",'5. Ident, assessment & log'!G7)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H7),\"\",'5. Ident, assessment & log'!H7)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I7),\"\",'5. Ident, assessment & log'!I7)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J7),\"\",'5. Ident, assessment & log'!J7)","v":""}]
["Breach identification, assessment and logging",5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.3","\tReference guidance (eg ICO's personal data breach criteria). ",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E8),\"\",'5. Ident, assessment & log'!E8)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F8),\"\",'5. Ident, assessment & log'!F8)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G8),\"\",'5. Ident, assessment & log'!G8)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H8),\"\",'5. Ident, assessment & log'!H8)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I8),\"\",'5. Ident, assessment & log'!I8)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J8),\"\",'5. Ident, assessment & log'!J8)","v":""}]
["Breach identification, assessment and logging",5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.4","\tPut in place guidance to assess whether there is a 'high risk' to affected people.",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E9),\"\",'5. Ident, assessment & log'!E9)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F9),\"\",'5. Ident, assessment & log'!F9)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G9),\"\",'5. Ident, assessment & log'!G9)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H9),\"\",'5. Ident, assessment & log'!H9)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I9),\"\",'5. Ident, assessment & log'!I9)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J9),\"\",'5. Ident, assessment & log'!J9)","v":""}]
["Breach identification, assessment and logging",5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.5","\tAssess personal data breaches on a case-by-case basis.",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E10),\"\",'5. Ident, assessment & log'!E10)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F10),\"\",'5. Ident, assessment & log'!F10)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G10),\"\",'5. Ident, assessment & log'!G10)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H10),\"\",'5. Ident, assessment & log'!H10)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I10),\"\",'5. Ident, assessment & log'!I10)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J10),\"\",'5. Ident, assessment & log'!J10)","v":""}]
["Breach identification, assessment and logging",5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.6","Include the following factors in the assessment of a personal data breach: \n- \tthe type of personal data breach (eg an incident where information has been disclosed to an unauthorised person will cause a different set of consequences than an incident which has resulted in information no longer being available);\n- \tthe type, sensitivity and volume of personal information;\n- \tthe vulnerability of those affected, including any potential cultural and political sensitivities;\n- \tthe number of people affected;\n- \twhether the incident has been contained (eg information has been located and returned, confirmation that the information has been securely destroyed or deleted by the unintended recipient, lost or stolen devices have been remotely wiped, system passwords have been changed);\n- \twho has subsequently had access to the information and whether it could it be used in a malicious way; and \n- \tthe consequences of the personal data breach after any mitigation.",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E11),\"\",'5. Ident, assessment & log'!E11)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F11),\"\",'5. Ident, assessment & log'!F11)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G11),\"\",'5. Ident, assessment & log'!G11)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H11),\"\",'5. Ident, assessment & log'!H11)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I11),\"\",'5. Ident, assessment & log'!I11)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J11),\"\",'5. Ident, assessment & log'!J11)","v":""}]
["Breach identification, assessment and logging",5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.7","\tPut in place a breach response plan that includes measures to proactively address effects and is focused on protecting the affected people and containing the personal data breach. ",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E12),\"\",'5. Ident, assessment & log'!E12)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F12),\"\",'5. Ident, assessment & log'!F12)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G12),\"\",'5. Ident, assessment & log'!G12)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H12),\"\",'5. Ident, assessment & log'!H12)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I12),\"\",'5. Ident, assessment & log'!I12)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J12),\"\",'5. Ident, assessment & log'!J12)","v":""}]
["Breach identification, assessment and logging",5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.8","\tEnsure relevant staff have a complete understanding of the security measures used (eg encryption or anonymisation) and they are assessing risks correctly.",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E13),\"\",'5. Ident, assessment & log'!E13)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F13),\"\",'5. Ident, assessment & log'!F13)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G13),\"\",'5. Ident, assessment & log'!G13)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H13),\"\",'5. Ident, assessment & log'!H13)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I13),\"\",'5. Ident, assessment & log'!I13)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J13),\"\",'5. Ident, assessment & log'!J13)","v":""}]
["Breach identification, assessment and logging",5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.9","\tTest notification and communication channels between affected departments.",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E14),\"\",'5. Ident, assessment & log'!E14)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F14),\"\",'5. Ident, assessment & log'!F14)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G14),\"\",'5. Ident, assessment & log'!G14)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H14),\"\",'5. Ident, assessment & log'!H14)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I14),\"\",'5. Ident, assessment & log'!I14)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J14),\"\",'5. Ident, assessment & log'!J14)","v":""}]
["Breach identification, assessment and logging",5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.10","\tAdd highlighted risks to the organisational risk register and any data protection impact assessment.",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E15),\"\",'5. Ident, assessment & log'!E15)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F15),\"\",'5. Ident, assessment & log'!F15)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G15),\"\",'5. Ident, assessment & log'!G15)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H15),\"\",'5. Ident, assessment & log'!H15)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I15),\"\",'5. Ident, assessment & log'!I15)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J15),\"\",'5. Ident, assessment & log'!J15)","v":""}]
["Breach identification, assessment and logging",5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.11","\tEnsure new risks are communicated to relevant operational staff.",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E16),\"\",'5. Ident, assessment & log'!E16)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F16),\"\",'5. Ident, assessment & log'!F16)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G16),\"\",'5. Ident, assessment & log'!G16)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H16),\"\",'5. Ident, assessment & log'!H16)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I16),\"\",'5. Ident, assessment & log'!I16)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J16),\"\",'5. Ident, assessment & log'!J16)","v":""}]
["Breach identification, assessment and logging",5.3,"Measures are in place to record personal data breaches. ","5.3.1","Put a breach log in place that records the facts about the personal data breach, its possible effects on the affected people and the measures taken in response.",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E17),\"\",'5. Ident, assessment & log'!E17)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F17),\"\",'5. Ident, assessment & log'!F17)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G17),\"\",'5. Ident, assessment & log'!G17)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H17),\"\",'5. Ident, assessment & log'!H17)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I17),\"\",'5. Ident, assessment & log'!I17)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J17),\"\",'5. Ident, assessment & log'!J17)","v":""}]
[{"$f":"A46","v":"Breach identification, assessment and logging"},5.3,"Measures are in place to record personal data breaches. ","5.3.2","\tPut a process in place to record near-misses that did not result in a personal data breach, but had potential to. ",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E18),\"\",'5. Ident, assessment & log'!E18)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F18),\"\",'5. Ident, assessment & log'!F18)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G18),\"\",'5. Ident, assessment & log'!G18)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H18),\"\",'5. Ident, assessment & log'!H18)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I18),\"\",'5. Ident, assessment & log'!I18)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J18),\"\",'5. Ident, assessment & log'!J18)","v":""}]
["Breach identification, assessment and logging",5.3,"Measures are in place to record personal data breaches. ","5.3.3","\tEscalate near misses and personal data breaches into the information risk process.",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E19),\"\",'5. Ident, assessment & log'!E19)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F19),\"\",'5. Ident, assessment & log'!F19)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G19),\"\",'5. Ident, assessment & log'!G19)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H19),\"\",'5. Ident, assessment & log'!H19)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I19),\"\",'5. Ident, assessment & log'!I19)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J19),\"\",'5. Ident, assessment & log'!J19)","v":""}]
["Breach identification, assessment and logging",5.3,"Measures are in place to record personal data breaches. ","5.3.4","\tRegularly review the breach logs (or relevant reports) at a senior strategic level.",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E20),\"\",'5. Ident, assessment & log'!E20)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F20),\"\",'5. Ident, assessment & log'!F20)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G20),\"\",'5. Ident, assessment & log'!G20)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H20),\"\",'5. Ident, assessment & log'!H20)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I20),\"\",'5. Ident, assessment & log'!I20)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J20),\"\",'5. Ident, assessment & log'!J20)","v":""}]
["Breach identification, assessment and logging",5.3,"Measures are in place to record personal data breaches. ","5.3.5","\tSet out a retention period for breach logs that contain personal information and establish a lawful basis for their retention.",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E21),\"\",'5. Ident, assessment & log'!E21)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F21),\"\",'5. Ident, assessment & log'!F21)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G21),\"\",'5. Ident, assessment & log'!G21)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H21),\"\",'5. Ident, assessment & log'!H21)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I21),\"\",'5. Ident, assessment & log'!I21)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J21),\"\",'5. Ident, assessment & log'!J21)","v":""}]
["Breach identification, assessment and logging",5.3,"Measures are in place to record personal data breaches. ","5.3.6","\tRegularly review the contents of breach logs for possible excessive retention.",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E22),\"\",'5. Ident, assessment & log'!E22)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F22),\"\",'5. Ident, assessment & log'!F22)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G22),\"\",'5. Ident, assessment & log'!G22)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H22),\"\",'5. Ident, assessment & log'!H22)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I22),\"\",'5. Ident, assessment & log'!I22)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J22),\"\",'5. Ident, assessment & log'!J22)","v":""}]
["Breach identification, assessment and logging",5.3,"Measures are in place to record personal data breaches. ","5.3.7","\tTake steps to periodically reduce the personal information held in breach logs (eg by using data minimisation or anonymisation techniques).",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E23),\"\",'5. Ident, assessment & log'!E23)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F23),\"\",'5. Ident, assessment & log'!F23)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G23),\"\",'5. Ident, assessment & log'!G23)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H23),\"\",'5. Ident, assessment & log'!H23)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I23),\"\",'5. Ident, assessment & log'!I23)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J23),\"\",'5. Ident, assessment & log'!J23)","v":""}]
["Breach identification, assessment and logging",5.3,"Measures are in place to record personal data breaches. ","5.3.8","\tEvidence that logs are regularly deleted in line with the retention schedule.",{"$f":"IF(ISBLANK('5. Ident, assessment & log'!E24),\"\",'5. Ident, assessment & log'!E24)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!F24),\"\",'5. Ident, assessment & log'!F24)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!G24),\"\",'5. Ident, assessment & log'!G24)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!H24),\"\",'5. Ident, assessment & log'!H24)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!I24),\"\",'5. Ident, assessment & log'!I24)","v":""},{"$f":"IF(ISBLANK('5. Ident, assessment & log'!J24),\"\",'5. Ident, assessment & log'!J24)","v":""}]
["Reporting processes",6.1,"Procedures are in place to report personal data breaches to the ICO, where required.","6.1.1","\tIdentify and record the lead supervisory authority (for the UK, this is the ICO), particularly if there is potential for a cross-border breach. Include this in your breach response plan.",{"$f":"IF(ISBLANK('6. Reporting processes'!E2),\"\",'6. Reporting processes'!E2)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!F2),\"\",'6. Reporting processes'!F2)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!G2),\"\",'6. Reporting processes'!G2)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!H2),\"\",'6. Reporting processes'!H2)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!I2),\"\",'6. Reporting processes'!I2)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!J2),\"\",'6. Reporting processes'!J2)","v":""}]
[{"$f":"A54","v":"Reporting processes"},{"$f":"B54","v":6.1},"Procedures are in place to report personal data breaches to the ICO, where required.","6.1.2","\tPut a process in place for reporting personal data breaches to the ICO. ",{"$f":"IF(ISBLANK('6. Reporting processes'!E3),\"\",'6. Reporting processes'!E3)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!F3),\"\",'6. Reporting processes'!F3)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!G3),\"\",'6. Reporting processes'!G3)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!H3),\"\",'6. Reporting processes'!H3)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!I3),\"\",'6. Reporting processes'!I3)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!J3),\"\",'6. Reporting processes'!J3)","v":""}]
["Reporting processes",6.1,"Procedures are in place to report personal data breaches to the ICO, where required.","6.1.3","Detail in the report (as a minimum); \n- \tthe nature of the personal data breach; \n- \tthe number of people and records affected; \n- \ta contact point (DPO); \n- \tthe likely consequences; and \n- \tany remedial measures you’ve taken, or will take, to address the effects of the personal data breach.",{"$f":"IF(ISBLANK('6. Reporting processes'!E4),\"\",'6. Reporting processes'!E4)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!F4),\"\",'6. Reporting processes'!F4)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!G4),\"\",'6. Reporting processes'!G4)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!H4),\"\",'6. Reporting processes'!H4)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!I4),\"\",'6. Reporting processes'!I4)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!J4),\"\",'6. Reporting processes'!J4)","v":""}]
["Reporting processes",6.1,"Procedures are in place to report personal data breaches to the ICO, where required.","6.1.4","\tReport a personal data breach to the ICO within the required timeframe, if a person's rights and freedoms are affected, or are likely to be.",{"$f":"IF(ISBLANK('6. Reporting processes'!E5),\"\",'6. Reporting processes'!E5)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!F5),\"\",'6. Reporting processes'!F5)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!G5),\"\",'6. Reporting processes'!G5)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!H5),\"\",'6. Reporting processes'!H5)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!I5),\"\",'6. Reporting processes'!I5)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!J5),\"\",'6. Reporting processes'!J5)","v":""}]
["Reporting processes",6.1,"Procedures are in place to report personal data breaches to the ICO, where required.","6.1.5","Put fall back procedures in place for: \n- \tout of office hours personal data breaches; \n- \tdecision-maker absences; and \n- \talternative notification routes (eg if a  communication channel has been compromised by the personal data breach).",{"$f":"IF(ISBLANK('6. Reporting processes'!E6),\"\",'6. Reporting processes'!E6)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!F6),\"\",'6. Reporting processes'!F6)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!G6),\"\",'6. Reporting processes'!G6)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!H6),\"\",'6. Reporting processes'!H6)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!I6),\"\",'6. Reporting processes'!I6)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!J6),\"\",'6. Reporting processes'!J6)","v":""}]
["Reporting processes",6.1,"Procedures are in place to report personal data breaches to the ICO, where required.","6.1.6","\tRecord decisions not to report a personal data breach or the reasons for any delays, along with any advice received from the supervisory authority (or other third party).",{"$f":"IF(ISBLANK('6. Reporting processes'!E7),\"\",'6. Reporting processes'!E7)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!F7),\"\",'6. Reporting processes'!F7)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!G7),\"\",'6. Reporting processes'!G7)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!H7),\"\",'6. Reporting processes'!H7)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!I7),\"\",'6. Reporting processes'!I7)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!J7),\"\",'6. Reporting processes'!J7)","v":""}]
["Reporting processes",6.1,"Procedures are in place to report personal data breaches to the ICO, where required.","6.1.7","\tEnsure the DPO is involved in assessing whether to report personal data breaches to the ICO.",{"$f":"IF(ISBLANK('6. Reporting processes'!E8),\"\",'6. Reporting processes'!E8)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!F8),\"\",'6. Reporting processes'!F8)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!G8),\"\",'6. Reporting processes'!G8)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!H8),\"\",'6. Reporting processes'!H8)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!I8),\"\",'6. Reporting processes'!I8)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!J8),\"\",'6. Reporting processes'!J8)","v":""}]
["Reporting processes",6.1,"Procedures are in place to report personal data breaches to the ICO, where required.","6.1.8","\tRetain evidence of internal and external communications during any personal data breaches.",{"$f":"IF(ISBLANK('6. Reporting processes'!E9),\"\",'6. Reporting processes'!E9)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!F9),\"\",'6. Reporting processes'!F9)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!G9),\"\",'6. Reporting processes'!G9)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!H9),\"\",'6. Reporting processes'!H9)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!I9),\"\",'6. Reporting processes'!I9)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!J9),\"\",'6. Reporting processes'!J9)","v":""}]
["Reporting processes",6.2,"Procedures are in place to notify affected people of a personal data breach where appropriate.","6.2.1","\tPut a process in place for informing people about a personal data breach, where necessary, and agree the potential ways to do so.",{"$f":"IF(ISBLANK('6. Reporting processes'!E10),\"\",'6. Reporting processes'!E10)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!F10),\"\",'6. Reporting processes'!F10)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!G10),\"\",'6. Reporting processes'!G10)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!H10),\"\",'6. Reporting processes'!H10)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!I10),\"\",'6. Reporting processes'!I10)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!J10),\"\",'6. Reporting processes'!J10)","v":""}]
[{"$f":"A62","v":"Reporting processes"},6.2,"Procedures are in place to notify affected people of a personal data breach where appropriate.","6.2.2","Have a communications template for sending clear and plain information to affected people, which includes: \n- \tthe name and contact details of the DPO;\n- \tthe likely consequences of the personal data breach; and\n- \t the measures taken to address the personal data breach.",{"$f":"IF(ISBLANK('6. Reporting processes'!E11),\"\",'6. Reporting processes'!E11)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!F11),\"\",'6. Reporting processes'!F11)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!G11),\"\",'6. Reporting processes'!G11)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!H11),\"\",'6. Reporting processes'!H11)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!I11),\"\",'6. Reporting processes'!I11)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!J11),\"\",'6. Reporting processes'!J11)","v":""}]
["Reporting processes",6.2,"Procedures are in place to notify affected people of a personal data breach where appropriate.","6.2.3","\tPut in place an alternative notification method should contacting everyone individually require disproportionate effort.",{"$f":"IF(ISBLANK('6. Reporting processes'!E12),\"\",'6. Reporting processes'!E12)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!F12),\"\",'6. Reporting processes'!F12)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!G12),\"\",'6. Reporting processes'!G12)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!H12),\"\",'6. Reporting processes'!H12)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!I12),\"\",'6. Reporting processes'!I12)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!J12),\"\",'6. Reporting processes'!J12)","v":""}]
["Reporting processes",6.2,"Procedures are in place to notify affected people of a personal data breach where appropriate.","6.2.4","\tDocument decisions involving disproportionate effort.",{"$f":"IF(ISBLANK('6. Reporting processes'!E13),\"\",'6. Reporting processes'!E13)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!F13),\"\",'6. Reporting processes'!F13)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!G13),\"\",'6. Reporting processes'!G13)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!H13),\"\",'6. Reporting processes'!H13)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!I13),\"\",'6. Reporting processes'!I13)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!J13),\"\",'6. Reporting processes'!J13)","v":""}]
["Reporting processes",6.2,"Procedures are in place to notify affected people of a personal data breach where appropriate.","6.2.5","\tPut a process in place to inform people at a later point, if there is insufficient information to contact them at the time of the personal data breach or contact details have been lost as a result of the incident.",{"$f":"IF(ISBLANK('6. Reporting processes'!E14),\"\",'6. Reporting processes'!E14)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!F14),\"\",'6. Reporting processes'!F14)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!G14),\"\",'6. Reporting processes'!G14)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!H14),\"\",'6. Reporting processes'!H14)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!I14),\"\",'6. Reporting processes'!I14)","v":""},{"$f":"IF(ISBLANK('6. Reporting processes'!J14),\"\",'6. Reporting processes'!J14)","v":""}]
["Feedback and lessons learned",7.1,"Procedures are in place to investigate personal data breaches and support organisational learning.","7.1.1","\tConduct a formal investigation or root cause analysis (RCA) after a significant personal data breach has occurred.",{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!E2),\"\",'7. Feedback & lessons learned'!E2)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!F2),\"\",'7. Feedback & lessons learned'!F2)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!G2),\"\",'7. Feedback & lessons learned'!G2)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!H2),\"\",'7. Feedback & lessons learned'!H2)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!I2),\"\",'7. Feedback & lessons learned'!I2)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!J2),\"\",'7. Feedback & lessons learned'!J2)","v":""}]
[{"$f":"A67","v":"Feedback and lessons learned"},{"$f":"B67","v":7.1},{"$f":"C67","v":"Procedures are in place to investigate personal data breaches and support organisational learning."},"7.1.2","\tReport the results of investigations or RCAs to senior or strategic management.",{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!E3),\"\",'7. Feedback & lessons learned'!E3)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!F3),\"\",'7. Feedback & lessons learned'!F3)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!G3),\"\",'7. Feedback & lessons learned'!G3)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!H3),\"\",'7. Feedback & lessons learned'!H3)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!I3),\"\",'7. Feedback & lessons learned'!I3)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!J3),\"\",'7. Feedback & lessons learned'!J3)","v":""}]
["Feedback and lessons learned",7.1,"Procedures are in place to investigate personal data breaches and support organisational learning.","7.1.3","\tRecord the findings from investigations or RCAs on the risk register, where appropriate, or feed into the information risk process.",{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!E4),\"\",'7. Feedback & lessons learned'!E4)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!F4),\"\",'7. Feedback & lessons learned'!F4)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!G4),\"\",'7. Feedback & lessons learned'!G4)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!H4),\"\",'7. Feedback & lessons learned'!H4)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!I4),\"\",'7. Feedback & lessons learned'!I4)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!J4),\"\",'7. Feedback & lessons learned'!J4)","v":""}]
["Feedback and lessons learned",7.1,"Procedures are in place to investigate personal data breaches and support organisational learning.","7.1.4","\tPeriodically re-evaluate risks from previous personal data breaches.",{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!E5),\"\",'7. Feedback & lessons learned'!E5)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!F5),\"\",'7. Feedback & lessons learned'!F5)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!G5),\"\",'7. Feedback & lessons learned'!G5)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!H5),\"\",'7. Feedback & lessons learned'!H5)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!I5),\"\",'7. Feedback & lessons learned'!I5)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!J5),\"\",'7. Feedback & lessons learned'!J5)","v":""}]
["Feedback and lessons learned",7.1,"Procedures are in place to investigate personal data breaches and support organisational learning.","7.1.5","\tPut a methodology in place to capture lessons learned.",{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!E6),\"\",'7. Feedback & lessons learned'!E6)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!F6),\"\",'7. Feedback & lessons learned'!F6)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!G6),\"\",'7. Feedback & lessons learned'!G6)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!H6),\"\",'7. Feedback & lessons learned'!H6)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!I6),\"\",'7. Feedback & lessons learned'!I6)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!J6),\"\",'7. Feedback & lessons learned'!J6)","v":""}]
["Feedback and lessons learned",7.1,"Procedures are in place to investigate personal data breaches and support organisational learning.","7.1.6","\tIdentify common trends through analysis and reviews of personal data breaches.",{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!E7),\"\",'7. Feedback & lessons learned'!E7)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!F7),\"\",'7. Feedback & lessons learned'!F7)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!G7),\"\",'7. Feedback & lessons learned'!G7)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!H7),\"\",'7. Feedback & lessons learned'!H7)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!I7),\"\",'7. Feedback & lessons learned'!I7)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!J7),\"\",'7. Feedback & lessons learned'!J7)","v":""}]
["Feedback and lessons learned",7.1,"Procedures are in place to investigate personal data breaches and support organisational learning.","7.1.7","\tPut processes in place to feedback lessons learned to staff and policy reviewers.",{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!E8),\"\",'7. Feedback & lessons learned'!E8)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!F8),\"\",'7. Feedback & lessons learned'!F8)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!G8),\"\",'7. Feedback & lessons learned'!G8)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!H8),\"\",'7. Feedback & lessons learned'!H8)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!I8),\"\",'7. Feedback & lessons learned'!I8)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!J8),\"\",'7. Feedback & lessons learned'!J8)","v":""}]
["Feedback and lessons learned",7.1,"Procedures are in place to investigate personal data breaches and support organisational learning.","7.1.8","\tShare the collective learnings from personal data breaches to embed lessons learned. Particularly if the type of processing is common across other business areas (including across any different sites or locations).",{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!E9),\"\",'7. Feedback & lessons learned'!E9)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!F9),\"\",'7. Feedback & lessons learned'!F9)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!G9),\"\",'7. Feedback & lessons learned'!G9)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!H9),\"\",'7. Feedback & lessons learned'!H9)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!I9),\"\",'7. Feedback & lessons learned'!I9)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!J9),\"\",'7. Feedback & lessons learned'!J9)","v":""}]
["Feedback and lessons learned",7.1,"Procedures are in place to investigate personal data breaches and support organisational learning.","7.1.9","\tFeed the issues into the audit programme to provide assurance that staff are following correct or improved procedures.",{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!E10),\"\",'7. Feedback & lessons learned'!E10)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!F10),\"\",'7. Feedback & lessons learned'!F10)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!G10),\"\",'7. Feedback & lessons learned'!G10)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!H10),\"\",'7. Feedback & lessons learned'!H10)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!I10),\"\",'7. Feedback & lessons learned'!I10)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!J10),\"\",'7. Feedback & lessons learned'!J10)","v":""}]
["Feedback and lessons learned",7.1,"Procedures are in place to investigate personal data breaches and support organisational learning.","7.1.10","Put key performance indicators in place and report these to senior or strategic management, for example on the number:\n- \tof personal data breaches and near misses; \n- \treported to the ICO; and \n- \tresulting in notifications to people.",{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!E11),\"\",'7. Feedback & lessons learned'!E11)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!F11),\"\",'7. Feedback & lessons learned'!F11)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!G11),\"\",'7. Feedback & lessons learned'!G11)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!H11),\"\",'7. Feedback & lessons learned'!H11)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!I11),\"\",'7. Feedback & lessons learned'!I11)","v":""},{"$f":"IF(ISBLANK('7. Feedback & lessons learned'!J11),\"\",'7. Feedback & lessons learned'!J11)","v":""}]

{"sheet":"Tables & graphs","index":3,"n_rows":27,"n_cols":9,"rows_kept":27,"cut":false,"hidden":true,"merged":[]}
[null,"1. Accountability","2. Policies & Procedures","3. Training","4. 3rd party arrangements","5. Identification, assessment & logs","6. Reporting process","7. Feedback & lessons learned","Total"]
["Fully meeting our expectation",{"$f":"COUNTIF('1. Accountability'!E:E,A2)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!E:E,A2)","v":0},{"$f":"COUNTIF('3. Training '!E:E,A2)","v":0},{"$f":"COUNTIF('4. 3rd party arrangements'!E:E,A2)","v":0},{"$f":"COUNTIF('5. Ident, assessment & log'!E:E,A2)","v":0},{"$f":"COUNTIF('6. Reporting processes'!E:E,A2)","v":0},{"$f":"COUNTIF('7. Feedback & lessons learned'!E:E,A2)","v":0},{"$f":"SUM(B2:H2)","v":0}]
["Partially meeting our expectation",{"$f":"COUNTIF('1. Accountability'!E:E,A3)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!E:E,A3)","v":0},{"$f":"COUNTIF('3. Training '!E:E,A3)","v":0},{"$f":"COUNTIF('4. 3rd party arrangements'!E:E,A3)","v":0},{"$f":"COUNTIF('5. Ident, assessment & log'!E:E,A3)","v":0},{"$f":"COUNTIF('6. Reporting processes'!E:E,A3)","v":0},{"$f":"COUNTIF('7. Feedback & lessons learned'!E:E,A3)","v":0},{"$f":"SUM(B3:H3)","v":0}]
["Not meeting our expectation",{"$f":"COUNTIF('1. Accountability'!E:E,A4)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!E:E,A4)","v":0},{"$f":"COUNTIF('3. Training '!E:E,A4)","v":0},{"$f":"COUNTIF('4. 3rd party arrangements'!E:E,A4)","v":0},{"$f":"COUNTIF('5. Ident, assessment & log'!E:E,A4)","v":0},{"$f":"COUNTIF('6. Reporting processes'!E:E,A4)","v":0},{"$f":"COUNTIF('7. Feedback & lessons learned'!E:E,A4)","v":0},{"$f":"SUM(B4:H4)","v":0}]
["Not Applicable",{"$f":"COUNTIF('1. Accountability'!E:E,A5)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!E:E,A5)","v":0},{"$f":"COUNTIF('3. Training '!E:E,A5)","v":0},{"$f":"COUNTIF('4. 3rd party arrangements'!E:E,A5)","v":0},{"$f":"COUNTIF('5. Ident, assessment & log'!E:E,A5)","v":0},{"$f":"COUNTIF('6. Reporting processes'!E:E,A5)","v":0},{"$f":"COUNTIF('7. Feedback & lessons learned'!E:E,A5)","v":0},{"$f":"SUM(B5:H5)","v":0}]
["Blank",{"$f":"COUNTBLANK('1. Accountability'!E2:E5)","v":4},{"$f":"COUNTBLANK('2. Policies and procedures'!E2:E7)","v":6},{"$f":"COUNTBLANK('3. Training '!E2:E11)","v":10},{"$f":"COUNTBLANK('4. 3rd party arrangements'!E2:E9)","v":8},{"$f":"COUNTBLANK('5. Ident, assessment & log'!E2:E24)","v":23},{"$f":"COUNTBLANK('6. Reporting processes'!E2:E14)","v":13},{"$f":"COUNTBLANK('7. Feedback & lessons learned'!E2:E11)","v":10},{"$f":"SUM(B6:H6)","v":74}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"1. Accountability","2. Policies & Procedures","3. Training","4. 3rd party arrangements","5. Identification, assessment & logs","6. Reporting process","7. Feedback & lessons learned","Total"]
["Not started",{"$f":"COUNTIF('1. Accountability'!I:I,A18)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!I:I,A18)","v":0},{"$f":"COUNTIF('3. Training '!I:I,A18)","v":0},{"$f":"COUNTIF('4. 3rd party arrangements'!I:I,A18)","v":0},{"$f":"COUNTIF('5. Ident, assessment & log'!I:I,A18)","v":0},{"$f":"COUNTIF('6. Reporting processes'!I:I,A18)","v":0},{"$f":"COUNTIF('7. Feedback & lessons learned'!I:I,A18)","v":0},{"$f":"SUM(B18:H18)","v":0}]
["Action rejected",{"$f":"COUNTIF('1. Accountability'!I:I,A19)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!I:I,A19)","v":0},{"$f":"COUNTIF('3. Training '!I:I,A19)","v":0},{"$f":"COUNTIF('4. 3rd party arrangements'!I:I,A19)","v":0},{"$f":"COUNTIF('5. Ident, assessment & log'!I:I,A19)","v":0},{"$f":"COUNTIF('6. Reporting processes'!I:I,A19)","v":0},{"$f":"COUNTIF('7. Feedback & lessons learned'!I:I,A19)","v":0},0]
["On track",{"$f":"COUNTIF('1. Accountability'!I:I,A20)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!I:I,A20)","v":0},{"$f":"COUNTIF('3. Training '!I:I,A20)","v":0},{"$f":"COUNTIF('4. 3rd party arrangements'!I:I,A20)","v":0},{"$f":"COUNTIF('5. Ident, assessment & log'!I:I,A20)","v":0},{"$f":"COUNTIF('6. Reporting processes'!I:I,A20)","v":0},{"$f":"COUNTIF('7. Feedback & lessons learned'!I:I,A20)","v":0},0]
["Overdue",{"$f":"COUNTIF('1. Accountability'!I:I,A21)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!I:I,A21)","v":0},{"$f":"COUNTIF('3. Training '!I:I,A21)","v":0},{"$f":"COUNTIF('4. 3rd party arrangements'!I:I,A21)","v":0},{"$f":"COUNTIF('5. Ident, assessment & log'!I:I,A21)","v":0},{"$f":"COUNTIF('6. Reporting processes'!I:I,A21)","v":0},{"$f":"COUNTIF('7. Feedback & lessons learned'!I:I,A21)","v":0},0]
["Completed",{"$f":"COUNTIF('1. Accountability'!I:I,A22)","v":0},{"$f":"COUNTIF('2. Policies and procedures'!I:I,A22)","v":0},{"$f":"COUNTIF('3. Training '!I:I,A22)","v":0},{"$f":"COUNTIF('4. 3rd party arrangements'!I:I,A22)","v":0},{"$f":"COUNTIF('5. Ident, assessment & log'!I:I,A22)","v":0},{"$f":"COUNTIF('6. Reporting processes'!I:I,A22)","v":0},{"$f":"COUNTIF('7. Feedback & lessons learned'!I:I,A22)","v":0},0]
["Blank",{"$f":"COUNTBLANK('1. Accountability'!I2:I5)","v":4},{"$f":"COUNTBLANK('2. Policies and procedures'!I2:I7)","v":6},{"$f":"COUNTBLANK('3. Training '!I2:I11)","v":10},{"$f":"COUNTBLANK('4. 3rd party arrangements'!I2:I9)","v":8},{"$f":"COUNTBLANK('5. Ident, assessment & log'!I2:I24)","v":23},{"$f":"COUNTBLANK('6. Reporting processes'!I2:I14)","v":13},{"$f":"COUNTBLANK('7. Feedback & lessons learned'!I2:I11)","v":10},74]
[]
[]
[null,"Not started","Action rejected","On track","Overdue","Completed","Blank"]
[null,{"$f":"SUM(B18:H18)","v":0},{"$f":"SUM(B19:H19)","v":0},{"$f":"SUM(B20:H20)","v":0},{"$f":"SUM(B21:H21)","v":0},{"$f":"SUM(B22:H22)","v":0},{"$f":"SUM(B23:H23)","v":74}]

{"sheet":"Lookup","index":4,"n_rows":9,"n_cols":7,"rows_kept":9,"cut":false,"hidden":true,"merged":[]}
["Fully meeting our expectation",null,null,null,"Not started",null,"Not started"]
["Partially meeting our expectation",null,null,null,"Action rejected",null,"In progress"]
["Not meeting our expectation",null,null,null,"On track",null,"Overdue"]
["Not Applicable",null,null,null,"Overdue",null,"Completed"]
[null,null,null,null,"Completed"]
[]
[]
["2000-01-01"]
[{"$f":"TODAY()","v":"2024-09-17"}]

{"sheet":"1. Accountability","index":5,"n_rows":5,"n_cols":10,"rows_kept":5,"cut":false,"hidden":false,"merged":[[1,1,4,1],[1,0,4,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action Owner","Action Status","Due date\n(DD/MM/YYYY)"]
[1.1000000000000001,"Nominated staff are assigned to oversee and make decisions on personal data breaches. They should be senior and experienced enough to make informed decisions.","1.1.1","\tAllocate ultimate responsibility for assessing and reporting personal data breaches at board or senior management level."]
[null,null,"1.1.2","\tAllocate day-to-day management and decision-making responsibilities to oversee your response to personal data breaches, including decisions on whether to report and escalate, where appropriate."]
[null,null,"1.1.3","\tDesignate a person or team to document the progress and actions taken in response to personal data breaches. "]
[null,null,"1.1.4","\tReflect these responsibilities in the relevant job descriptions."]

{"sheet":"2. Policies and procedures","index":6,"n_rows":7,"n_cols":10,"rows_kept":7,"cut":false,"hidden":false,"merged":[[1,1,6,1],[1,0,6,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action Owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[2.1,"There is a documented approach to managing security incidents resulting in a personal data breach that is regularly reviewed to allow the organisation to plan effectively.","2.1.1","\tHave a breach notification policy with clear guidance for staff to follow in the event of a personal data breach."]
[null,null,"2.1.2","Put procedures in place for breach management and incident response teams to follow in the event of a personal data breach, including escalation, where appropriate."]
[null,null,"2.1.3","\tMake policies and procedures readily available to all staff (eg intranet, starter packs).  "]
[null,null,"2.1.4","\tRegularly review policies and procedures, including recording the review dates, versions and change log."]
[null,null,"2.1.5","\tReview policies and procedures in light of any personal data breaches or near misses. "]
[null,null,"2.1.6","\tDocument within policies and procedures, a set of criteria to assess both the severity of the personal data breach and the likely effect on people's rights and freedoms. Include references to guidance (eg ICO guidance) and provide particular guidance on how to assess a 'high risk' to affected people."]

{"sheet":"3. Training ","index":7,"n_rows":11,"n_cols":10,"rows_kept":11,"cut":false,"hidden":false,"merged":[[1,1,7,1],[1,0,7,0],[8,1,10,1],[8,0,10,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons fo Status","Actions","Action Owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[3.1,"Staff with responsibility for processing personal information are able to recognise and escalate personal data breaches.","3.1.1","\tTrain staff to recognise and report personal data breaches before they work with personal information."]
[{"$f":"A2","v":3.1},"Staff with responsibility for processing personal information are able to recognise and escalate personal data breaches.","3.1.2","\tProvide periodic staff refresher training to recognise and escalate personal data breaches."]
[3.1,"Staff with responsibility for processing personal information are able to recognise and escalate personal data breaches.","3.1.3","\tReinforce training with reminders (eg posters, newsletter sections, emails and intranet bulletins)."]
[3.1,"Staff with responsibility for processing personal information are able to recognise and escalate personal data breaches.","3.1.4","\tIncorporate anonymised examples of personal data breaches into data protection training, particularly if training is tailored to specific business areas."]
[3.1,"Staff with responsibility for processing personal information are able to recognise and escalate personal data breaches.","3.1.5","\tInclude in the training an adequate explanation of how each personal data breach occurred to raise awareness and mitigate against future occurrences of each type of incident."]
[3.1,"Staff with responsibility for processing personal information are able to recognise and escalate personal data breaches.","3.1.6","\tProvide written, easily accessible staff guidance on recognising and handling personal data breaches."]
[3.1,"Staff with responsibility for processing personal information are able to recognise and escalate personal data breaches.","3.1.7","\tImplement a culture of trust so employees feel able to report near misses."]
[3.2,"Decision-makers are equipped to make informed decisions about personal data breaches.","3.2.1","\tProvide specialised personal data breach training to decision makers so they are able to effectively carry out this aspect of their role."]
[{"$f":"A9","v":3.2},"Decision-makers are equipped to make informed decisions about personal data breaches.","3.2.2","\tProvide supplementary guidance to personal data breach decision makers (eg security incident flowcharts)."]
[3.2,"Decision-makers are equipped to make informed decisions about personal data breaches.","3.2.3","\tRegularly refresh specialised training. "]

{"sheet":"4. 3rd party arrangements","index":8,"n_rows":9,"n_cols":10,"rows_kept":9,"cut":false,"hidden":false,"merged":[[1,1,4,1],[1,0,4,0],[5,1,8,1],[5,0,8,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action owner","Action Status","Due date\n(DD/MM/YYY)"]
[4.0999999999999996,"Arrangements are in place with joint controllers in the event of a personal data breach.","4.1.1","\tIdentify any controllers who you jointly process information with. "]
[{"$f":"A2","v":4.0999999999999996},"Arrangements are in place with joint controllers in the event of a personal data breach.","4.1.2","\tDetermine with joint controllers your respective responsibilities for handling personal data breaches."]
[4.0999999999999996,"Arrangements are in place with joint controllers in the event of a personal data breach.","4.1.3","\tAgree communication channels between the parties in the event of a personal data breach, including nominated points of contact."]
[4.0999999999999996,"Arrangements are in place with joint controllers in the event of a personal data breach.","4.1.4","\tTest breach communication channels and procedures with joint controllers."]
[4.2,"Contracts are in place between the controller and any processors working on their behalf that reflect the processor's obligations in the event of a personal data breach.","4.2.1","\tPut in place contractual agreements with processors that specify how to meet the requirements of article 33 of the UK GDPR and each parties' responsibilities if a personal data breach occurs."]
[{"$f":"A6","v":4.2},"Contracts are in place between the controller and any processors working on their behalf that reflect the processor's obligations in the event of a personal data breach.","4.2.2","\tInclude any agreed arrangements for the processor to report a personal data breach on your behalf."]
[4.2,"Contracts are in place between the controller and any processors working on their behalf that reflect the processor's obligations in the event of a personal data breach.","4.2.3","\tAgree and document timescales for processors to report suspected personal data breaches to you. "]
[4.2,"Contracts are in place between the controller and any processors working on their behalf that reflect the processor's obligations in the event of a personal data breach.","4.2.4","\tAgree communication channels between parties in the event of a personal data breach and nominated points of contact."]

{"sheet":"5. Ident, assessment & log","index":9,"n_rows":24,"n_cols":10,"rows_kept":24,"cut":false,"hidden":false,"merged":[[1,1,4,1],[1,0,4,0],[5,1,15,1],[5,0,15,0],[16,1,23,1],[16,0,23,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action owner","Action Status","Due date\n(DD/MM/YYYY)"]
[5.0999999999999996,"Measures are in place to prevent and detect personal data breaches.","5.1.1","Put in place appropriate organisational measures to prevent personal data breaches, for example: \n- \tinformation security policies and procedures; \n- \trisk assessments; \n- \tinternal audits; \n- \tfraud detection reviews; or\n- \tthird-party notification procedures."]
[{"$f":"A2","v":5.0999999999999996},"Measures are in place to prevent and detect personal data breaches.","5.1.2","Put in place appropriate technical measures to promptly detect personal data breaches, for example: \n- \tdata flow and log analysers;\n- \tintrusion detection systems and intrusion prevention systems or firewalls that can alert to and identify actual personal data breaches; \n- \tdata leakage control; and \n- \taccess logging."]
[5.0999999999999996,"Measures are in place to prevent and detect personal data breaches.","5.1.3","\tEnsure there is an effective process to identify, investigate and respond to any suspected offences under section 170 DPA 18. "]
[5.0999999999999996,"Measures are in place to prevent and detect personal data breaches.","5.1.4","\tEnsure there is a threshold for a reasonable level of certainty\" that a personal data breach has occurred."]
[5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.1","\tRecord the type of personal and special category information held."]
[{"$f":"A6","v":5.2},{"$f":"B6","v":"Measures are in place to assess the severity of personal data breaches."},"5.2.2","\tDocument and put in place criteria to assess the severity of the personal data breach and the likely effect on people's rights and freedoms"]
[5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.3","\tReference guidance (eg ICO's personal data breach criteria). "]
[5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.4","\tPut in place guidance to assess whether there is a 'high risk' to affected people."]
[5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.5","\tAssess personal data breaches on a case-by-case basis."]
[5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.6","Include the following factors in the assessment of a personal data breach: \n- \tthe type of personal data breach (eg an incident where information has been disclosed to an unauthorised person will cause a different set of consequences than an incident which has resulted in information no longer being available);\n- \tthe type, sensitivity and volume of personal information;\n- \tthe vulnerability of those affected, including any potential cultural and political sensitivities;\n- \tthe number of people affected;\n- \twhether the incident has been contained (eg information has been located and returned, confirmation that the information has been securely destroyed or deleted by the unintended recipient, lost or stolen devices have been remotely wiped, system passwords have been changed);\n- \twho has subsequently had access to the information and whether it could it be used in a malicious way; and \n- \tthe consequences of the personal data breach after any mitigation."]
[5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.7","\tPut in place a breach response plan that includes measures to proactively address effects and is focused on protecting the affected people and containing the personal data breach. "]
[5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.8","\tEnsure relevant staff have a complete understanding of the security measures used (eg encryption or anonymisation) and they are assessing risks correctly."]
[5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.9","\tTest notification and communication channels between affected departments."]
[5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.10","\tAdd highlighted risks to the organisational risk register and any data protection impact assessment."]
[5.2,"Measures are in place to assess the severity of personal data breaches.","5.2.11","\tEnsure new risks are communicated to relevant operational staff."]
[5.3,"Measures are in place to record personal data breaches. ","5.3.1","Put a breach log in place that records the facts about the personal data breach, its possible effects on the affected people and the measures taken in response."]
[{"$f":"A17","v":5.3},"Measures are in place to record personal data breaches. ","5.3.2","\tPut a process in place to record near-misses that did not result in a personal data breach, but had potential to. "]
[5.3,"Measures are in place to record personal data breaches. ","5.3.3","\tEscalate near misses and personal data breaches into the information risk process."]
[5.3,"Measures are in place to record personal data breaches. ","5.3.4","\tRegularly review the breach logs (or relevant reports) at a senior strategic level."]
[5.3,"Measures are in place to record personal data breaches. ","5.3.5","\tSet out a retention period for breach logs that contain personal information and establish a lawful basis for their retention."]
[5.3,"Measures are in place to record personal data breaches. ","5.3.6","\tRegularly review the contents of breach logs for possible excessive retention."]
[5.3,"Measures are in place to record personal data breaches. ","5.3.7","\tTake steps to periodically reduce the personal information held in breach logs (eg by using data minimisation or anonymisation techniques)."]
[5.3,"Measures are in place to record personal data breaches. ","5.3.8","\tEvidence that logs are regularly deleted in line with the retention schedule."]

{"sheet":"6. Reporting processes","index":10,"n_rows":14,"n_cols":10,"rows_kept":14,"cut":false,"hidden":false,"merged":[[1,1,8,1],[1,0,8,0],[9,1,13,1],[9,0,13,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[6.1,"Procedures are in place to report personal data breaches to the ICO, where required.","6.1.1","\tIdentify and record the lead supervisory authority (for the UK, this is the ICO), particularly if there is potential for a cross-border breach. Include this in your breach response plan."]
[{"$f":"A2","v":6.1},"Procedures are in place to report personal data breaches to the ICO, where required.","6.1.2","\tPut a process in place for reporting personal data breaches to the ICO. "]
[6.1,"Procedures are in place to report personal data breaches to the ICO, where required.","6.1.3","Detail in the report (as a minimum); \n- \tthe nature of the personal data breach; \n- \tthe number of people and records affected; \n- \ta contact point (DPO); \n- \tthe likely consequences; and \n- \tany remedial measures you’ve taken, or will take, to address the effects of the personal data breach."]
[6.1,"Procedures are in place to report personal data breaches to the ICO, where required.","6.1.4","\tReport a personal data breach to the ICO within the required timeframe, if a person's rights and freedoms are affected, or are likely to be."]
[6.1,"Procedures are in place to report personal data breaches to the ICO, where required.","6.1.5","Put fall back procedures in place for: \n- \tout of office hours personal data breaches; \n- \tdecision-maker absences; and \n- \talternative notification routes (eg if a  communication channel has been compromised by the personal data breach)."]
[6.1,"Procedures are in place to report personal data breaches to the ICO, where required.","6.1.6","\tRecord decisions not to report a personal data breach or the reasons for any delays, along with any advice received from the supervisory authority (or other third party)."]
[6.1,"Procedures are in place to report personal data breaches to the ICO, where required.","6.1.7","\tEnsure the DPO is involved in assessing whether to report personal data breaches to the ICO."]
[6.1,"Procedures are in place to report personal data breaches to the ICO, where required.","6.1.8","\tRetain evidence of internal and external communications during any personal data breaches."]
[6.2,"Procedures are in place to notify affected people of a personal data breach where appropriate.","6.2.1","\tPut a process in place for informing people about a personal data breach, where necessary, and agree the potential ways to do so."]
[{"$f":"A10","v":6.2},"Procedures are in place to notify affected people of a personal data breach where appropriate.","6.2.2","Have a communications template for sending clear and plain information to affected people, which includes: \n- \tthe name and contact details of the DPO;\n- \tthe likely consequences of the personal data breach; and\n- \t the measures taken to address the personal data breach."]
[6.2,"Procedures are in place to notify affected people of a personal data breach where appropriate.","6.2.3","\tPut in place an alternative notification method should contacting everyone individually require disproportionate effort."]
[6.2,"Procedures are in place to notify affected people of a personal data breach where appropriate.","6.2.4","\tDocument decisions involving disproportionate effort."]
[6.2,"Procedures are in place to notify affected people of a personal data breach where appropriate.","6.2.5","\tPut a process in place to inform people at a later point, if there is insufficient information to contact them at the time of the personal data breach or contact details have been lost as a result of the incident."]

{"sheet":"7. Feedback & lessons learned","index":11,"n_rows":11,"n_cols":10,"rows_kept":11,"cut":false,"hidden":false,"merged":[[1,0,10,0],[1,1,10,1]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[7.1,"Procedures are in place to investigate personal data breaches and support organisational learning.","7.1.1","\tConduct a formal investigation or root cause analysis (RCA) after a significant personal data breach has occurred."]
[null,null,"7.1.2","\tReport the results of investigations or RCAs to senior or strategic management."]
[null,null,"7.1.3","\tRecord the findings from investigations or RCAs on the risk register, where appropriate, or feed into the information risk process."]
[null,null,"7.1.4","\tPeriodically re-evaluate risks from previous personal data breaches."]
[null,null,"7.1.5","\tPut a methodology in place to capture lessons learned."]
[null,null,"7.1.6","\tIdentify common trends through analysis and reviews of personal data breaches."]
[null,null,"7.1.7","\tPut processes in place to feedback lessons learned to staff and policy reviewers."]
[null,null,"7.1.8","\tShare the collective learnings from personal data breaches to embed lessons learned. Particularly if the type of processing is common across other business areas (including across any different sites or locations)."]
[null,null,"7.1.9","\tFeed the issues into the audit programme to provide assurance that staff are following correct or improved procedures."]
[null,null,"7.1.10","Put key performance indicators in place and report these to senior or strategic management, for example on the number:\n- \tof personal data breaches and near misses; \n- \treported to the ICO; and \n- \tresulting in notifications to people."]