| Field | Notes |
|---|---|
| Date discovered | |
| What happened | |
| Data involved | client details, appointment notes, access information, documents, images, invoices, payments, and messages. |
| People affected | |
| Immediate action taken | |
| Risk decision | Is there a risk to people? Was ICO reporting considered? |
| Outcome | |
| Prevention | What document, process, supplier, access, or training change is needed? |