Data breach protocol

A suspected data breach involving student or staff data on BoomReader/BoomWriter must be handled immediately and follow the defined roles under the UK GDPR. The School is the Data Controller and holds the legal responsibility for notifying the Information Commissioner’s Office (ICO). BoomApps (Squirrel Learning Ltd) is the Data Processor and is responsible for containing the breach and assisting the School.

The following flowchart outlines the necessary steps for a suspected data breach.

Flowchart for Suspected Data Breach (BoomApps)

Stage 1: Initial Discovery and Triage

Reporter	Initial Action
Parent/Guardian	Contact the School immediately. The parent must report the suspected breach directly to the school’s Data Protection Officer or designated contact.
School Staff	Immediate Contact to Processor: Staff must notify the BoomApps Data Protection Contact without undue delay. Email: data@boomhub.app

Stage 2: Investigation and Mitigation (Processor’s Responsibility)

Action 1: Processor Notification and Containment Once notified by the School, BoomApps (Squirrel Learning Ltd) MUST:

• Contain: Immediately take steps to contain the breach (e.g., suspend access, isolate systems).
• Investigate: Conduct an internal investigation and forensic analysis to determine the cause, scope, and data subjects affected.
• Mitigate: Take all measures necessary to remedy or mitigate the effects of the Security Incident.
• Report: Provide the School (Controller) with all timely information and cooperation required.

Stage 3: Risk Assessment and Regulatory Notification (Controller’s Responsibility)

The School (Data Controller) uses the Processor's findings to complete a risk assessment.

Step	Decision Point (School's Assessment)	Required Action by Data Controller (School)
Step 1	(Initial Action) The School reviews the BoomApps investigation report (from Stage 2) to determine the nature, scope, and impact of the breach on data subjects' rights and freedoms.	The School Assesses the RISK to data subjects' rights and freedoms, documenting the findings
Step 2	Is the breach UNLIKELY to result in a risk to the rights and freedoms of natural persons (students, staff, parents)?	NO REGULATORY ACTION REQUIRED. The incident must be fully documented internally. (PROCESS ENDS)
Step 3	Is the breach LIKELY to result in a risk to the rights and freedoms of natural persons?	NOTIFY THE ICO. The School must notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach.
Step 4	Is the risk to data subjects HIGH (i.e., high probability of serious detriment)?	NOTIFY DATA SUBJECTS. The School must notify the affected Data Subjects (parents, staff, etc.) without undue delay.

Explanation of Responsibilities

• Parent/Guardian: Must always contact the School first, as the School is the legal owner (Controller) of the data.
• School Staff (Data Controller): Upon discovery or receipt of a parent report, the School must immediately notify the Data Processor to start the technical investigation.
  • BoomApps DPO Contact: the Data Team, data@boomhub.app
• BoomApps (Data Processor): Is responsible for internal investigation and providing the School with the facts necessary for the risk assessment.
• Final Regulatory Step: The School holds the legal responsibility to notify the ICO (Information Commissioner's Office) if a risk to data subjects is likely. If the risk is high, the School must also notify the affected individuals.