When the authority contacts you.
WHAT TRIGGERS CONTACT
A complaint from an individual A reported breach A sector inquiry A media report
WHAT TO DO FIRST
Read what is actually being asked.
WHAT TO DO SECOND
Note the deadline.
WHAT TO DO THIRD
Involve whoever holds responsibility, and consider legal advice.
WHAT TO AVOID
Responding informally Missing the deadline Providing more than was asked Providing less than was asked
WHY MORE IS A PROBLEM
It expands the enquiry.
WHY LESS IS A PROBLEM
It appears evasive.
WHAT TO PROVIDE
What was requested, accurately, on time.
WHAT TO PRESERVE
Everything relevant, immediately.
WHY
Routine deletion may otherwise remove records.
WHAT TO BE HONEST ABOUT
Failures.
WHY
Regulators respond far better to acknowledged failings with remediation than to denial.
WHAT TO DEMONSTRATE
That you took obligations seriously What you have changed
WHAT TO NEVER DO
Alter records Mislead
WHAT TO DOCUMENT
Every communication.
WHAT TO DO AFTERWARDS
Implement what you committed to.
WHY
Follow-up enquiries check.
