School data breach response: a step-by-step guide for Irish schools

The first hour

Visit the URL. Screenshot everything. Note the timestamp. Download what you can before it disappears. Not tomorrow, not after the staff meeting.

Then stop it continuing:

• If it is your email system sending data to the wrong list, disable it.
• If it is a compromised account, lock it.
• If it is a misconfigured cloud folder, pull the permissions.

The breach has already happened. The job in the first hour is containment, not explanation.

The 72-hour window

The Data Protection Commission has to be notified within 72 hours — from discovery, not from when the breach happened. Four things go in the notification:

• Nature of the breach — what data, how many people, what categories. "Student medical records and home addresses for 47 pupils in 3rd Year" is specific. "Some information" is negligent.
• Likely consequences — identity theft risk, safeguarding concerns, privacy violation. Name it.
• Measures taken — what you have done and what you are doing. Not what you intend to consider.
• Contact point — one person, one email, one phone number. Usually you.

Most schools miss the deadline because they are still investigating. You notify on what you know at the time and update afterwards; the clock does not wait for a complete picture.

Telling parents

The letter goes out the same day you confirm the breach. Not when you have worked out how it happened. Not when you are less embarrassed.

Template language does not help here, and it needs to come from you rather than from the school office.

The investigation worth running

Here is what most schools get wrong: they investigate who made the mistake.

The question that matters is why the mistake was possible.

If a member of staff accidentally sent medical records to the wrong group, that is human error, and human error happens everywhere. If the system let them do it with two clicks and no confirmation prompt, that is a system failure. People make mistakes. Systems either prevent them or enable them.

After the panic

Update the Data Protection Impact Assessment — not because the DPC might check it, but because it is the record of what you learned. What happened, what you changed, what you are monitoring now.

Six months later, run the scenario again with staff: if this happened tomorrow, what would we do differently? If the answer is "nothing", nothing was learned. If it includes new procedures, updated training or different systems, you are building something.

Schools that handle breaches well are not luckier. The difference between a contained incident and a catastrophic one is whether the protocols existed before they were needed.