Imagine a helpline staffed by people who learned their own data was exposed just minutes before taking the first call. This was the reality at Royal Cornwall Hospitals NHS Trust after a spreadsheet exposed health data for 8,003 people. The call center was meant to run for two weeks but ended up operating for 11.
Most breach plans cover notification, containment, and regulator contact. Few address the needs of the people answering the phones. If you're a Data Protection Officer (DPO), it's your responsibility to fill that gap.
Why These Mistakes Keep Happening
Breach response plans often focus on the first 72 hours. Article 33 of the GDPR drives this timeline, centering plans on 72-hour notification and supervisory authority contact. The response to affected individuals under Article 34 is often seen as a task: send letters, open a helpline, and consider it done.
Helplines are staffed by whoever is available, with no dedicated ownership or budget. This leads to several common mistakes.
Mistake 1: Treating the Helpline as an Afterthought
Why it happens: Article 34 requires communication to affected individuals, often seen as a deliverable rather than an ongoing operation. The helpline appears in plans as a single line item.
The consequence: At Royal Cornwall, clinical governance staff were informed just a day ahead that they'd run the helpline. The script arrived 30 minutes before launch, and some staff hadn't finished reading it when calls began.
The fix: Include the helpline as its own workstream in your breach response plan, complete with an owner, budget, and readiness gate. Don't go live until the script is delivered, read, and rehearsed. If you can't meet this, delay the line and use interim written communication.
Mistake 2: Assuming Clinical or Professional Experience Substitutes for Call Training
Why it happens: Leaders assume experienced staff can handle upset callers. While Royal Cornwall staff had experience with patient trauma, it wasn't enough.
The consequence: Callers were angry and distressed. The review found staff carried a significant emotional burden without adequate preparation or support.
The fix: Provide call handlers with a focused curriculum before the first call:
- De-escalation techniques for angry callers
- Confirmed details about the exposed data
- Scripted responses for "I don't know yet" to prevent speculation
- How to explain the Right to Lodge a Complaint
- Consistent call logging to identify patterns in your Breach Register
Mistake 3: Making Staff Improvise Safeguarding Decisions
Why it happens: Breach plans often model data risk, not personal risk. They don't consider what happens if exposed data belongs to someone in a dangerous situation.
The consequence: Call handlers at Royal Cornwall had to make safeguarding assessments without training. Some callers were distressed by the sensitivity of the disclosures or potentially in danger from domestic abuse. Untrained staff making these calls creates risk for both the caller and the handler.
The fix: During your risk assessment, consider whether any affected individuals could face physical or personal safety harm if the data is misused. If so, establish an escalation path before launch. Name a safeguarding lead who is reachable during helpline hours. Define triggers for escalation clearly. Ensure handlers know they never decide alone. ISO/IEC 29134 impact assessment thinking is useful here, as it focuses on harm to individuals.
Mistake 4: Forgetting That Your Responders Are Also Data Subjects
Why it happens: Teams plan responses as if responders are outside the incident. In an employee-data breach, they're not.
The consequence: Most Royal Cornwall call handlers learned their own data had been exposed while working on the helpline, sometimes minutes before supporting others.
The fix: Before staffing a helpline for an employee-data breach, check if proposed handlers are among the affected. Notify them first, give them time to process, and let them opt out without penalty. If the affected population is your workforce, consider using external or contracted handlers initially.
Mistake 5: Running the Helpline on Goodwill and Open-Ended Hours
Why it happens: The two-week estimate is optimistic, and nobody revisits it. Staff maintain their day jobs because no backfill was approved.
The consequence: The helpline ran for 11 weeks. Staff maintained their usual duties and worked long hours. One staffer noted, "It's typical NHS, it runs on goodwill." Goodwill isn't a control. It runs out, and burnout degrades call quality.
The fix: Plan for volume to exceed estimates. Set a review point at the end of week one and weekly after that. Pre-approve backfill so handlers are released from regular duties. Cap hours, rotate handlers, and schedule recovery time after difficult calls. Offer access to counseling or an employee assistance service from day one.
The Root Cause Worth Fixing Too
The helpline strain traced back to a preventable breach. A spreadsheet published in response to a Freedom of Information request retained pivot-table data that exposed sensitive health information. The request went to a team without expertise in complex datasets. Critical steps were skipped, and sign-off focused on answering questions rather than ensuring data was sanitized. Procedure changes, such as converting to CSV, weren't part of the formal operating procedure.
Prevention training and response training are linked. Your Technical and Organisational Measures should cover both the publishing workflow and the people who deal with its failure.
Prevention Checklist
- Your breach plan names an owner for the affected-individual response, separate from the technical response
- A readiness gate blocks helpline launch until scripts, training, and escalation paths are in place
- Call handlers receive de-escalation training and a briefing on confirmed facts
- A safeguarding escalation path exists, with a named lead and defined triggers
- You've checked whether proposed handlers are among the affected, and notified them first
- Backfill, hour caps, and rotation are approved before launch
- Counseling or wellbeing support is available from day one
- A weekly review tests whether the planned duration still holds
- Call logs feed your Breach Register so recurring concerns surface early
- Your operating procedures, not just circulated guidance, reflect every control you've added after a breach
A breach response is judged by its impact on the people on both ends of the line. Plan for both.
