Information Security Incident Policy and Procedure

As a data controller, Greater Manchester Police (GMP) is aware of its responsibilities under the Data Protection Act 2018 and the UK General Data Protection Regulation (GDPR) to ensure appropriate and proportionate security of the personal data it holds.

GMP has a duty under the principles of the UK GDPR to ensure that the personal data it stores and uses is kept safe and secure and protected from loss, destruction, or unauthorised disclosure.

Aims

GMP has a duty under the UK GDPR to report certain types of personal data breaches to the Information Commissioner’s Office (ICO).

Although technical and organisational measures are taken to prevent the unauthorised or unlawful processing of personal data, there may be occasions when this happens.

This policy and procedure outline the position of the organisation in respect of such incidents and the action that needs to take place as a consequence.