On the basis that your organisation may not only want to seek a prosecution for the data breach but may potentially face litigation itself, it’s important to preserve any potential evidence. “As soon as the severity of an incident escalates, organisations must ‘freeze frame’ and ensure that evidence is preserved. The preservation of evidence must be undertaken using very specific equipment used by a trained computer forensic service,” Martin advises.

To ensure that any data can be forensically analysed and be eventually admissible in a court, it is vital to physically secure any computer or media to ensure “continuity of evidence”, he explains. The easiest way to do this is to physically lock away any servers, PCs or other hardware that might be related to the breach.

As well as locking away the evidence it’s also important to contain news of the security breach. Given that the majority of breaches are still, whether intentionally or not, carried out by employees, it makes sense to make sure that the minimum of people are informed about the breach or data loss. “Keep only one or two people informed of the investigation as you might be tipping off a culprit who, in turn, may start destroying evidence,” says Martin.

Having identified what data is missing, what impact it might have on the organization and even, potentially, who might have been responsible, the issue of whether to report the incident will come to the fore. The decision on whether to report will depend on several factors, not least what kind of data has been lost or exposed.

“There is always a problem with the reporting issue within a private-sector company because of the confidence loss with customers and shareholders. The other side of the coin is that you have a duty of care if you hold personal data on people and you lose that data, then yes, you have to make it public very quickly,” says Telecity Group’s Donson, who spent 27 years in divisions such as the National Hi-Tech Crime Unit, the National Crime Squad, and the Computer Crime Unit, and also teaches Computer Forensics and Information Security at Westminster University.

Donson claims that in his experience a lot of data breaches that don’t involve personal data go unreported. “I think there are lots of other kinds of data that aren’t personal and don’t get reported,” he says.

However, law enforcement agencies are obviously keen that organizations report the loss of any kind of data – whether it be data covered under the Data Protection Act or not – as it helps enormously with the data intelligence gathering process, according to Donson. And reporting the incident to police doesn’t have to mean it will be made public. “We had non-disclosure agreements in place so we were saying to people, ‘Report it to us, even if you don’t want any action taken that is fine’,” says Donson. “We wouldn’t act on it if the company didn’t want us to act on it.”