Data Breach Management – When the Big One Hits
When a major data breach hits, it rarely arrives with warning and the consequences can be far-reaching. Customer trust is shaken, operations are disrupted, regulators demand answers, and the clock starts ticking on decisions that can define an organisation’s reputation for years to come. In these moments, preparation is not optional; it is critical.
Data Breach Management is about far more than an IT response. It requires clear leadership, coordinated decision-making, legal and regulatory awareness, effective communication, and the ability to act decisively under pressure. Organisations that have planned and practised their response are measurably better at containing damage, meeting legal obligations, and maintaining stakeholder confidence when the worst happens.
Data Breach Management – When the Big One Hits equips leaders and response teams with the practical skills, frameworks, and confidence to manage a serious data breach end-to-end. By understanding what to do, who needs to be involved, and how to make the right calls at speed, organisations can move from reactive crisis to controlled response—protecting their people, their data, and their reputation when it matters most.
By the end of this workshop you will be able to:
• identify what constitutes a personal data breach and assess when notification obligations arise
• respond appropriately to a personal data breach in line with ICO and other relevant regulatory expectations
• manage communications (internal and external) and the media
• support and advise senior management on breach preparedness and risk mitigation strategies
• implement practical preparatory measures, including incident response planning and internal escalation processes
• maintain and use an internal personal data breach register effectively to demonstrate accountability and compliance
• improve cyber resilience
Key Topics
- The definition of a personal data breach and the types of incidents that give rise to notification obligations
- The steps organisations should take following a personal data breach, including regulatory expectations of the ICO and other relevant supervisory authorities
- Preparatory actions organisations should be implementing now, including strategies for securing senior management engagement and support
- Incident response planning and practical opportunities to mitigate legal, operational, and reputational risk
- The requirement to maintain an internal personal data breach register and guidance on how to manage it effectively
- How to improve cyber resilience
- How to implement their Business Continuity Plan in the event of a large breach
- Managing communications (internal and external) and the media in event of a large breach
- Mitigating risks of dealing with data on the dark web and ransomware groups
- Managing contact from thousands of data subjects who may have been affected
Dates & Cost
Online
£449 plus VAT
Classroom
£499 plus VAT
Timings: 10am to 4pm
Course tutors
All our associates are experienced information governance professionals who have been training and advising in this field for many years.
What our clients say about us
I would highly recommend the GDPR Practitioner Course. The Tutor was extremely knowledgeable and gave plenty of chance for group conversation or individual questions. A great course for anyone wanting to expand their knowledge of GDPR and understand putting the principles into practise.
SL, BCH
I would highly recommend the GDPR Practitioner Course. The Tutor was extremely knowledgeable and gave plenty of chance for group conversation or individual questions. A great course for anyone wanting to expand their knowledge of GDPR and understand putting the principles into practise.
SL, BCH
I learned so much! The course was just the right balance of theory and practical, and was very well delivered.
CB, CHAS
The course was very useful as an IG Officer. The trainer was knowledgeable and explained some complex aspects of the legislation using interesting examples and real life scenarios. As a refresher, even with lots of work experience behind me, it was very useful to undertake the Practitioner course. The course materials and handbook are invaluable and I know I will re-use them in conjunction with my usual resources.
NC, Lincolnshire County Council
A very practical and all-encompassing coverage of the UK GDPR provided over 4 days. Although 4 days is not enough time to cover this whole subject in depth, there was just enough covered with further resources and links provided within the sessions to cover all aspects of the GDPR to a level at which I now feel a lot more confident in my role. Thank you, Kirsty!
SW, Norwich University of the Arts
