| Field | Notes |
|---|---|
| Date discovered | |
| What happened | |
| Data involved | client consultation forms, allergy notes, patch test records, treatment notes, before and after photos, appointment records, invoices, and marketing preferences. |
| People affected | |
| Immediate action taken | |
| Risk decision | Is there a risk to people? Was ICO reporting considered? |
| Outcome | |
| Prevention | What document, process, supplier, access, or training change is needed? |