Data Breach Policy - Quality Waste

QualityWaste Ltd – UK Waste Management Services
Effective Date: 2 June 2025

---

1. Purpose

This Data Breach Policy sets out how QualityWaste Ltd will respond in the event of a data breach involving personal or sensitive information. It ensures compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and outlines our commitment to transparency, accountability, and security.

---

2. Scope

This policy applies to:

• All personal data held by QualityWaste Ltd
• Employees, customers, suppliers, and contractors
• All digital systems, physical files, cloud storage, and communication tools
• Any data incident involving loss, unauthorised access, or accidental disclosure

---

3. What Is a Data Breach?

A data breach is any event where personal data is:

• Lost or stolen
• Accidentally or unlawfully disclosed
• Accessed without authorisation
• Altered or destroyed without permission

Examples:

• Sending personal information to the wrong recipient
• Malware or ransomware attacks
• Lost laptops or unencrypted USB drives
• Hacking or phishing incidents
• Exposure of customer data through website vulnerabilities

---

4. Our Commitment

QualityWaste Ltd is committed to:

• Detecting and responding to data breaches quickly
• Minimising impact on individuals and business operations
• Notifying the Information Commissioner’s Office (ICO) when legally required
• Informing affected individuals where there is a high risk to their rights or freedoms
• Preventing future breaches through improved controls

---

5. Breach Response Procedure

If a data breach is suspected or confirmed, the following steps will be taken:

Step 1: Identify and Contain

• Isolate affected systems or processes
• Preserve evidence and log details of the incident
• Notify the Data Protection Lead

Step 2: Assess the Risk

• Determine what data was affected and how
• Assess potential harm to individuals (e.g. identity theft, financial loss)

Step 3: Notify Authorities

• Report to the ICO within 72 hours if the breach is likely to result in risk to individuals’ rights and freedoms

Step 4: Inform Affected Individuals

• Provide details of the breach, potential consequences, and protective steps
• Offer guidance or support where applicable

Step 5: Document and Improve

• Record the breach, investigation, and outcome
• Review security policies and implement corrective actions

---

6. Staff Responsibilities

All employees must:

• Report any suspected or actual data breaches immediately
• Follow internal procedures for data handling and cyber security
• Participate in data protection and breach response training

---

7. Policy Review

This policy is reviewed annually or after any significant incident. Changes will be communicated to all staff and stakeholders.

---

8. Contact for Breach Reporting

If you suspect a data breach or have concerns regarding the safety of your personal data held by QualityWaste Ltd, please contact:

📧 sales@qualitywaste.co.uk
🌐 https://www.qualitywaste.co.uk