Data Breach & Incident Response Procedure

Last updated: 12 August 2026

Bentley Legal Support Services (“Bentley”, “we”, “us” or “our”) recognises that a loss, accidental disclosure, unauthorised access or other security incident involving personal or confidential information must be identified and dealt with promptly.

This procedure sets out the steps Bentley should take when an actual or suspected information-security or personal data incident occurs.

1. Purpose

The purpose of this procedure is to provide a clear and consistent response to incidents involving personal, confidential, legal, financial or commercially sensitive information.

2. What Is an Incident?

An incident may include:

• Loss or theft of paper documents
• Loss or theft of a laptop, phone or other device
• Personal information sent to the wrong recipient
• Unauthorised access to an account or system
• Accidental disclosure of confidential information
• Malware, ransomware or phishing attacks
• Compromised passwords or user accounts
• Unauthorised copying or downloading of information
• Accidental deletion or alteration of information
• Loss of photographs or GPS/location information
• Any other event that may compromise the confidentiality, integrity or availability of information

3. Immediate Reporting

Anyone who becomes aware of an actual or suspected incident should report it to Bentley as soon as reasonably possible.

Do not delay reporting while attempting to determine the full extent of the incident.

4. Immediate Containment

Where appropriate, immediate steps should be taken to contain the incident.

Depending on the circumstances, this may include:

• Disconnecting an affected device from the network
• Locking or disabling a compromised account
• Changing affected passwords
• Recalling or securing incorrectly sent information where possible
• Recovering lost documents or devices where safe to do so
• Restricting access to affected systems
• Preserving relevant evidence

Steps should be taken carefully so that important evidence is not unnecessarily destroyed.

5. Initial Assessment

Bentley should establish, as far as reasonably possible:

• What happened
• When it happened
• How the incident was discovered
• What information may be affected
• Whose information may be affected
• Whether client information is involved
• Whether the information was actually accessed or disclosed
• What immediate risks exist
• What steps have already been taken

6. Personal Data Breaches

Where personal data is involved, Bentley will assess whether the incident constitutes a personal data breach under applicable data protection law.

A personal data breach can include accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data.

7. Risk Assessment

The impact of an incident should be assessed according to the nature of the information involved and the potential consequences for affected individuals.

Considerations may include:

• The type of information involved
• The sensitivity of the information
• The number of individuals affected
• Whether the information was encrypted or otherwise protected
• Who may have accessed the information
• Whether the information has actually been used or disclosed
• The potential consequences for affected individuals

8. Notification to Clients

Where an incident affects personal or confidential information supplied by a client, Bentley will assess whether the client should be notified and, where appropriate, notify the client without undue delay.

The information provided should be sufficient to allow the client to understand the nature and potential impact of the incident based on what is reasonably known at the time.

9. Regulatory Notification

Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, the applicable notification requirements will be considered.

Where notification to the Information Commissioner’s Office is required, it should normally be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

If a high risk to individuals exists, communication to affected individuals will also be considered where required by law.

Whether notification is required depends on the circumstances and the applicable legal requirements.

10. Law Enforcement

Where an incident involves suspected theft, fraud, criminal activity or another matter requiring law-enforcement involvement, Bentley may contact the appropriate authority.

11. Evidence Preservation

Relevant evidence should be preserved where reasonably possible.

This may include:

• Emails
• System logs
• Messages
• Photographs
• Access records
• Device information
• Relevant documents

12. Client Documents

Where client documents are involved, Bentley will take reasonable steps to establish exactly what information may have been affected and whether the incident is likely to affect the client’s matter.

13. Lost or Stolen Devices

If a device containing Bentley or client information is lost or stolen, the incident should be reported immediately.

Where available, Bentley should use appropriate security controls such as remote locking, account revocation or remote wiping.

14. Incorrect Disclosure

If information is sent to the wrong person, Bentley should act promptly to:

• Contact the unintended recipient where appropriate
• Request deletion or return of the information
• Restrict further access where possible
• Record what information was disclosed
• Assess the associated risk
• Notify the client or regulator where required

15. Cybersecurity Incidents

Where Bentley suspects malware, ransomware, phishing, unauthorised access or another cyber incident, affected systems should be isolated where appropriate and access credentials changed as necessary.

External technical support may be engaged where specialist assistance is required.

16. Photography and Location Information

Where an incident involves photographs, GPS records or other location information collected during an assignment, Bentley should identify the affected information and take appropriate containment and notification steps.

17. Breach Register

Bentley should maintain an appropriate record of confirmed personal data breaches, including incidents that do not require notification to the ICO.

The record should contain sufficient information to demonstrate how the incident was assessed and handled.

18. Corrective Action

Following an incident, Bentley should identify measures that may reduce the likelihood of recurrence.

This may include:

• Password changes
• Additional access controls
• Software or security updates
• Staff guidance or training
• Changes to document handling
• Changes to storage or communication procedures
• Technical security improvements

19. Lessons Learned

Material incidents should be reviewed after containment to identify what happened, what worked, what did not work and what should change.

20. Confidentiality

Incident information should be handled confidentially and shared only with those who need it to investigate, contain, report or resolve the incident.

21. False or Suspected Incidents

Suspected incidents should be reported even where it later becomes clear that no personal data breach occurred.

Early reporting allows Bentley to assess the circumstances and take appropriate action.

22. Responsibilities

Everyone with access to Bentley information is responsible for reporting suspected incidents promptly.

Management is responsible for overseeing the incident response process and ensuring that appropriate action is taken.

23. Third-Party Incidents

Where an incident occurs at a third-party provider that affects Bentley or client information, Bentley will assess the impact and take appropriate action with the provider and affected client where necessary.

24. Business Continuity

Where an incident affects the availability of critical systems or information, Bentley will take reasonable steps to restore essential operations while maintaining appropriate security controls.

25. Review of Incidents

Incident records should be retained for an appropriate period so that Bentley can demonstrate how significant incidents were handled and identify recurring risks.

26. Changes to this Procedure

This procedure will be reviewed periodically and updated when necessary to reflect changes in technology, services, risks, regulatory requirements or business arrangements.

27. Related Policies

This procedure should be read together with Bentley’s:

Privacy Policy   |   Information Security Policy   |   Data Retention & Destruction Policy   |   Data Processing Addendum   |   Service Standards

28. Contact Us

Information-security or data-protection incidents should be reported promptly to:

Bentley Legal Support Services
Email: enquiries@bentleylegal.co.uk
Telephone: +44-7890-197837
Website: www.bentleylegal.co.uk

This procedure provides an operational framework for responding to information-security and personal data incidents. It should be reviewed against Bentley Legal Support Services’ actual systems, reporting arrangements, data-protection responsibilities and incident-response contacts before formal adoption.