Data Slips and Trips: Why Your School Needs a ‘Near-Miss’ Data Breach Log
A small mistake today could prevent a serious data breach tomorrow. But only if somebody records it, learns from it and takes action.
Schools are accustomed to recording accidents, injuries and near misses. A pupil trips over a loose carpet, a member of staff notices a damaged electrical cable, or somebody slips on a wet floor. Even when nobody is injured, the incident may be recorded so that the hazard can be removed before something more serious happens.
But what happens when the hazard involves personal information rather than physical safety? An email containing pupil information is nearly sent to the wrong parent. A confidential document is discovered in a classroom after a meeting. A member of staff leaves a computer unlocked, exposing a pupil's safeguarding information to anybody passing by. These incidents may not result in serious harm. Some may not even amount to a personal data breach. Nevertheless, they can provide valuable warnings about weaknesses in a school's information governance arrangements.
The principle is simple: if schools record physical near misses to prevent accidents, why shouldn't they record information governance near misses to prevent data breaches?
The Data Protection Equivalent of the School Accident Book
Every school understands the value of an accident book. It provides evidence of what happened, helps identify recurring problems and supports decisions about preventing future incidents. A data breach and near-miss log can serve much the same purpose.
Consider three examples:
Example 1: The email that nearly went astray
A school administrator prepares an email containing sensitive information about a pupil. Just before pressing Send, they notice that the email address belongs to another parent with a similar name. The mistake is corrected and the information is never disclosed. There may be no personal data breach, but there has been a near miss. If several staff members report similar problems, the school may need to review its email procedures, address books or use of autocomplete.
Example 2: The confidential file left on a desk
A member of staff finds a pupil's special educational needs file on an unattended desk in a room accessible to visitors. The file is recovered immediately. Nobody is known to have read it.
This requires assessment. Depending on the circumstances, unauthorised access may have occurred, or the school may be unable to establish whether the information was exposed.
It should not automatically be dismissed simply because nobody admits to seeing the file.
Example 3: The email sent to the wrong parent
A school accidentally emails a pupil's report to another parent. The recipient immediately contacts the school, confirms that the attachment has not been forwarded and agrees to delete it. This is a personal data breach, even if the recipient cooperates and the risk of harm is assessed as low. It must be documented internally, although it may not need reporting to the Information Commissioner's Office (ICO).
These examples illustrate an important distinction: not every near miss is a personal data breach, and not every personal data breach needs to be reported to the ICO. However, both types of incidents can help schools improve their procedures.
What Does the Law Actually Require?
The principal legislation is the UK General Data Protection Regulation (UK GDPR), supplemented by the Data Protection Act 2018 and relevant amendments, including the Data (Use and Access) Act 2025.
Several provisions are particularly relevant.
Article 5(1)(f) – Integrity and Confidentiality
Schools must process personal data in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage.
Article 5(2) – Accountability
Schools must be able to demonstrate compliance with the data protection principles.
Article 24 – Responsibility of the Controller
Schools, academy trusts and other relevant data controllers must implement appropriate measures to ensure and demonstrate compliance, taking account of the nature and risks of their processing.
Article 32 – Security of Processing
Schools must implement appropriate technical and organisational security measures, including procedures for assessing and reviewing their effectiveness.
Article 33 – Notification of a Personal Data Breach
This is particularly important.
Article 33(5) requires controllers to document personal data breaches, including the facts surrounding the breach, its effects and the remedial action taken. This documentation must be sufficient to enable the ICO to verify compliance. Importantly, this obligation applies to personal data breaches whether or not they are reportable to the ICO.
The UK GDPR does not expressly require every incident that was prevented before any breach occurred to be recorded as a near miss. However, maintaining a near-miss log is sensible, established risk-management practice. It supports accountability, security reviews and continuous improvement.
The 72-Hour Rule: What Schools Sometimes Misunderstand
Many school staff have heard that data breaches must be reported within 72 hours. Unfortunately, that message can create two misconceptions. The first is that every data breach must be reported to the ICO. The second is that an incident does not matter unless it is serious enough to report. Neither is correct. Under Article 33, a personal data breach must be notified to the ICO unless it is unlikely to result in a risk to the rights and freedoms of individuals.
Where notification is required, it must be made without undue delay and, where feasible, no later than 72 hours after the controller becomes aware of the breach. The clock does not simply start when the DPO happens to read an email about the incident. Schools therefore need effective internal reporting arrangements so that incidents are identified and escalated promptly.
There is also a higher threshold for informing affected individuals. Under Article 34, individuals must generally be informed without undue delay where a breach is likely to result in a high risk to their rights and freedoms, subject to the applicable exceptions. For example, accidentally disclosing a pupil's sensitive safeguarding records could have very different consequences from sending a routine, low-sensitivity message to the wrong recipient. The circumstances, the information involved, the people affected and the likely consequences all matter.
The correct approach is not to report everything to the ICO. It is to record all actual personal data breaches, assess the risk and report externally when the legal threshold is met.
Why Minor Incidents Matter More Than Schools Might Think
One accidentally misdirected email may be an isolated mistake. Ten similar incidents across different departments could indicate a systemic problem. A confidential document left on a desk might appear insignificant. Repeated incidents could suggest weaknesses in staff awareness, clear-desk arrangements or the handling of safeguarding information.
Near-miss records can help a school identify:
Recurring email addressing and attachment errors.
Inadequate controls over access to pupil or staff records.
Problems with printing, photocopying and confidential waste disposal.
Weaknesses in staff training or supervision.
Insecure storage of paper files and electronic records.
Risks associated with temporary staff, contractors and visitors.
Patterns involving particular systems, departments or working practices.
The purpose is not to create unnecessary paperwork. It is to identify the equivalent of a loose carpet before somebody trips over it.
A Simple Three-Step Procedure for School Staff
Staff should not be expected to become experts in data protection legislation before reporting an incident. Instead, every school should have a straightforward procedure that staff can remember and follow.
Step 1 – Contain the Incident
Take immediate, safe and proportionate action to prevent further disclosure, loss or damage.
This might include recalling an email where possible, contacting an unintended recipient, securing a misplaced file, restricting access to a system or informing the IT team. Do not delay containment while trying to decide whether the incident is legally reportable. Where appropriate, preserve relevant evidence, including email details, system logs and a record of actions taken.
Step 2 – Report and Record
Tell the school's designated incident contact promptly, following its internal reporting procedure. This may be the DPO, an information governance lead or another nominated member of staff. Provide the essential facts:
What happened, and when was it discovered?
What information was involved?
Whose information might have been affected?
Who may have received or accessed it?
What immediate action has been taken?
Staff should report factual information without speculation or assigning blame. The designated person should ensure the incident is recorded and escalated for assessment.
Step 3 – Assess, Resolve and Learn
The appropriate person, with DPO advice where required, should determine whether the incident amounts to a personal data breach and whether notification to the ICO or affected individuals is necessary. The assessment and reasons for the decision should be documented.
Where appropriate, the school should also identify any wider procedural weakness and decide what action is necessary to prevent recurrence.
That might mean improving training, changing an administrative process, introducing an additional check or strengthening technical security. Finally, somebody should be responsible for confirming that the agreed action has actually been completed.
Contain it. Record it. Learn from it.
Three straightforward steps that every member of school staff should understand.
The DPO's Role: Looking Beyond Individual Mistakes
An effective DPO should not simply become the person who receives bad news when something goes wrong. The DPO's statutory responsibilities under Article 39 include advising on compliance, monitoring compliance, supporting awareness and training, and providing advice on relevant data protection matters.
Reviewing incident patterns is a useful part of this wider monitoring and advisory role. For example, a DPO reviewing a school's records might notice that several incidents have involved staff attaching the wrong document to emails. Individually, the incidents may have presented little risk. Collectively, they could suggest a need for improved checking procedures or a more secure method of sharing documents.
The DPO can recommend improvements, while school leadership remains responsible for providing the resources, implementing appropriate controls and ensuring that risks are addressed. This is particularly important where the DPO is an external consultant or a member of staff whose data protection responsibilities form only part of their wider role.
What Do the ICO and Department for Education Recommend?
The ICO's personal data breach guidance makes clear that organisations must maintain records of personal data breaches, including those that do not require notification. Its wider security guidance also emphasises appropriate organisational measures, staff awareness, effective incident response and learning from security problems.
The Department for Education's Data protection in schools guidance reinforces the need for schools to understand their responsibilities, protect personal information and have appropriate arrangements for responding to breaches.
Schools should also consider the DfE's cyber security guidance and standards, particularly where an incident involves school IT systems, unauthorised access, compromised accounts or the loss of electronic information.
These sources support a practical approach: clear reporting responsibilities, prompt investigation, proportionate escalation, proper documentation and corrective action. For safeguarding information, the school must also consider the welfare of the child and any relevant safeguarding response. Data protection incident management must not delay necessary action to protect a child.
The Insight Information Governance Master Record
One challenge for schools is that information governance incidents and activities can become scattered across emails, notebooks, spreadsheets and individual members of staff. This makes it difficult to identify patterns, demonstrate accountability or provide a clear picture of the school's information governance arrangements.
To help address this, Insight Management Services and Information Governance Ltd provides its clients with an Information Governance Master Record. This one-stop resource is designed to help schools maintain a coordinated record of important information governance matters, including personal data breaches and related incidents.
Using a central record can make it easier to document what happened, record decisions and remedial action, track outstanding matters and review recurring problems. It also supports the wider objective of treating information governance as an ongoing management responsibility rather than something considered only when an incident occurs.
For Insight clients, the Information Governance Master Record provides a practical starting point for this approach.
Creating a Culture of Reporting, Not Blaming
Perhaps the greatest obstacle to effective near-miss reporting is not technology or legislation. It is human behaviour. Staff may be reluctant to admit that they nearly sent information to the wrong person or accidentally left a confidential file unattended. They may fear criticism, disciplinary action or being blamed for creating additional work.
Schools should encourage a proportionate, supportive reporting culture in which genuine mistakes are reported promptly and lessons are shared. This does not mean ignoring reckless behaviour, deliberate misuse of information or repeated disregard of established procedures. It means recognising that early reporting is usually far more valuable than discovering a problem weeks later.
A member of staff who promptly reports a mistake may enable the school to contain an incident before serious harm occurs. That behaviour should be encouraged. Training should reinforce the message that staff are not expected to make complex legal judgements about whether an incident is reportable. Their responsibility is to recognise a possible problem, take appropriate immediate action and report it. The assessment can then be undertaken by those with the necessary knowledge and authority.
Five Minutes Today Could Prevent a Major Problem Tomorrow
Recording a minor data protection incident may take only a few minutes. Failing to learn from it could eventually lead to a serious disclosure, safeguarding concern, regulatory investigation, reputational damage or loss of confidence among parents and staff.
A well-maintained breach and near-miss log is not simply a compliance document. It is an early-warning system. Schools already understand why they record accidents and physical near misses. Applying the same thinking to personal information is a logical extension of effective risk management.
The next time somebody says, “No harm done, so there's no need to record it”, perhaps the better question is: “What can we learn from this before it happens again?”
That is how schools move from simply reacting to data breaches towards actively preventing them.
About Insight MSIG
Insight Management Services and Information Governance Ltd provides specialist information governance, data protection and related advisory services to schools, academies and multi-academy trusts. Insight clients have access to practical guidance and resources, including the Information Governance Master Record, to support their day-to-day compliance responsibilities.
Website: www.insightmsig.co.uk
Email: insightmsig@outlook.co.uk
© Steve Cullen, Insight Management Services and Information Governance Ltd. October 2026.
Supporting sources and legal references
The article's central recommendation is expressly supported by the DfE's guidance, updated on 14 October 2026, which recommends reviewing every personal data breach or near miss, even where no risk is identified. The ICO also recommends a culture in which employees feel able to report near misses.
These authoritative sources can be linked directly from the published article:
Comments