IT & Cyber Security

Clear guidance on incidents, security controls, & GDPR‑aligned response

IT teams usually realise GDPR risk at the worst possible moment: during a security incident.

These answers explain how cyber security and GDPR intersect in practice:

• When operational and security incidents become data breaches
• What evidence IT teams are expected to provide
• How escalation, documentation, and response should work

Each page is written to help IT leaders act quickly, communicate clearly, and reduce regulatory exposure, without turning IT into legal or compliance teams.

How to use these answers

• Each page answers one practical IT or cyber‑related question
• Written for IT Directors, Heads of IT, CISOs, and security managers
• Designed to be shared internally with Legal, DPOs, and leadership
• Safe to rely on during live incidents and post‑incident reviews

These pages explain what good looks like when security incidents affect personal data.

Core IT & Cyber Questions

Cyber Security & GDPR Alignment

How security controls reduce GDPR risk

• How does cyber security support GDPR compliance?

Protecting personal data, reducing breach likelihood, and enabling defensible response.

• What technical and organisational measures does GDPR require?

Reasonable, risk‑based controls, not specific tools.

• How can IT reduce GDPR risk without slowing the running of a school?

Embedding security into processes and focusing on high‑risk data.

Incidents, Breaches & Escalation

When technical events become regulatory events

• When does a security incident become a data breach?

The decision points IT teams must recognise and escalate.

• What happens in the first 72 hours after a data breach?

Containment, assessment, evidence, and escalation.

• How should IT teams prepare for GDPR breach response?

Runbooks, roles, rehearsals, and evidence readiness.

• What does good incident readiness look like for IT?

Prepared teams, tested processes, and clear documentation.

Evidence, Investigations & Accountability

Supporting defensible decisions under scrutiny

• What role does IT play during a GDPR investigation?

Providing factual evidence, timelines, and system insight.

• What logs and evidence should IT retain for GDPR?

Access, activity, incident, and response records.

• How should IT work with the DPO during an incident?

Clear division of roles: facts from IT, advice from the DPO.

Third‑Party & Supplier Risk

Managing exposure beyond your own systems

• How should third‑party cyber risk be managed under GDPR?

Assessing supplier controls, monitoring risk, and documenting decisions.

What these answers are (and aren’t)

They are:

• Practical explanations of GDPR‑aligned security practice
• Written for real‑world IT environments
• Focused on decisions, escalation, and evidence

They are not:

• Tool recommendations
• Legal advice
• Theoretical security frameworks

Why this Hub exists

Many organisations have strong security tools but still struggle with GDPR because:

• Incidents aren’t escalated correctly
• Evidence isn’t captured early
• IT, Legal, and leadership aren’t aligned
• Decisions are made without documentation

This hub exists to explain how prepared IT teams avoid those failures.

How IT Teams use these pages

• During incident response
• To align with DPOs and Legal teams
• To explain technical issues to boards in plain English
• To support audits and investigations