Nurture Education – Data Breach & Incident Response Policy

Review Information

Item Data Breach and Incident policy Date 29.05.2026

Policy Review Date 29.05.2026

Next Review Date 29.06.2027

Contact Information

For questions relating to this policy or to report a data breach, contact: Nurture Education Data

Protection Lead: Andrew Marr Email: _ andrew@nurtureeducation.co.uk

Policy Statement

Nurture Education is committed to protecting the confidentiality, integrity, and availability of all

personal and sensitive information processed by the organisation.

The organisation recognises that data breaches and cyber incidents can have serious

consequences for candidates, employees, schools, children, and business operations. Nurture

Education is committed to responding promptly, effectively, and lawfully to any actual,

suspected, or attempted data breach or information security incident.

This policy sets out the procedures for identifying, reporting, managing, investigating, and

resolving data breaches and security incidents in accordance with:

• UK General Data Protection Regulation (UK GDPR)

• Data Protection Act 2018

• Information Commissioner’s Office (ICO) guidance

• Keeping Children Safe in Education (KCSIE) 2025

• UK cyber security best practice

Purpose

The purpose of this policy is to:

• Protect personal and sensitive data

• Minimise harm resulting from data breaches

• Ensure legal and regulatory compliance

• Establish clear reporting and escalation procedures

• Support rapid incident containment and recovery

• Maintain trust with schools, candidates, and stakeholders

• Reduce operational and safeguarding risks

Scope

This policy applies to:

• Employees

• Directors

• Consultants

• Agency workers

• Contractors

• Temporary staff

• Third-party service providers

The policy applies to all personal data processed by Nurture Education, including:

• Candidate records

• DBS and safeguarding information

• School and client data

• Employee records

• Payroll and financial information

• Electronic and paper records

• Email systems

• Cloud-based systems and CRM platforms

Definition of a Data Breach

A personal data breach means any security incident leading to the accidental or unlawful:

• Destruction

• Loss

• Alteration

• Unauthorised disclosure

• Unauthorised access

to personal data.

Examples include:

• Sending personal data to the wrong recipient

• Lost or stolen devices

• Unauthorised access to candidate files

• Cyber attacks or ransomware incidents

• Phishing attacks

• Accidental deletion of records

• DBS information disclosed improperly

• Password compromise

• Loss of paper records

• Unsecured email attachments

Roles and Responsibilities

Directors and Senior Management

Senior management are responsible for:

• Ensuring effective breach management procedures

• Allocating appropriate resources

• Reviewing serious incidents

• Ensuring regulatory compliance

• Supporting staff training and awareness

Data Protection Lead

The Data Protection Lead is responsible for:

• Coordinating breach investigations

• Assessing breach severity

• Determining reporting obligations

• Liaising with the ICO where required

• Maintaining breach records

• Leading post-incident reviews

Employees and Staff

All staff must:

• Report suspected breaches immediately

• Follow security procedures

• Protect confidential information

• Cooperate with investigations

• Complete required data protection training

Failure to report a known breach may result in disciplinary action.

Incident Reporting Procedure

Any employee or representative who becomes aware of a suspected or actual breach must

immediately report it to management or the Data Protection Lead.

Reports should include:

• Date and time of incident

• Nature of the breach

• Type of data involved

• Individuals affected

• How the breach occurred

• Immediate actions taken

Incidents must be reported immediately and without delay.

Immediate Response & Containment

Upon discovery of a breach, Nurture Education will take immediate steps to contain the

incident.

Actions may include:

• Recovering lost information

• Restricting system access

• Resetting passwords

• Isolating affected systems

• Disabling compromised accounts

• Contacting unintended recipients

• Suspending affected processes

• Engaging IT support or cyber specialists

Safeguarding risks relating to children or vulnerable individuals will be prioritised immediately.

Breach Risk Assessment

All incidents will be assessed to determine:

• The sensitivity of the information

• Number of individuals affected

• Risk of harm or identity theft

• Safeguarding implications

• Financial or reputational impact

• Likelihood of misuse

• Whether special category data is involved

• Whether DBS or safeguarding information is affected

The organisation will determine whether the breach poses a risk or high risk to individuals’

rights and freedoms.

ICO Reporting

Where legally required, Nurture Education will report personal data breaches to the Information

Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach.

The report may include:

• Nature of the breach

• Categories of affected data

• Number of individuals affected

• Likely consequences

• Mitigation measures taken

• Contact details for further information

Where the breach is not reported within 72 hours, reasons for delay will be documented.

Notification to Affected Individuals

Where a breach is likely to result in a high risk to individuals, affected persons will be informed

without undue delay.

Notifications may include:

• Description of the breach

• Information affected

• Potential consequences

• Actions already taken

• Steps individuals should take to protect themselves

• Contact information for support

Notifications will be clear, transparent, and timely.

Cyber Security Incidents

Nurture Education recognises the growing risk of cyber attacks within the education and

recruitment sectors.

Cyber incidents may include:

• Malware

• Ransomware

• Hacking attempts

• Phishing attacks

• Email compromise

• Unauthorised remote access

The organisation will:

• Maintain appropriate cyber security controls

• Use secure passwords and multi-factor authentication where possible

• Apply software updates and security patches

• Maintain antivirus and firewall protections

• Restrict system access based on role

• Conduct staff cyber awareness training

Safeguarding-Related Data Breaches

Where a breach involves safeguarding records, DBS information, allegations, or child

protection concerns:

• The Designated Safeguarding Lead (DSL) must be informed immediately

• Additional safeguarding risk assessments may be completed

• Relevant schools or authorities may be informed where necessary

• Child welfare considerations will take priority

Breach Register

Nurture Education will maintain a secure breach log containing:

• Incident reference number

• Date and time

• Nature of incident

• Individuals affected

• Risk assessment outcome

• Actions taken

• ICO reporting decisions

• Lessons learned

• Closure date

All breaches will be documented, including those not reportable to the ICO.

Investigation & Post-Incident Review

Following resolution of an incident, Nurture Education will complete a review to:

• Identify root causes

• Assess response effectiveness

• Improve controls and procedures

• Identify training needs

• Reduce likelihood of recurrence

Corrective actions may include:

• Policy updates

• Additional training

• Security improvements

• Disciplinary action where appropriate

• Supplier reviews

Training & Awareness

All staff will receive regular training covering:

• Data protection responsibilities

• Recognising data breaches

• Cyber security awareness

• Secure handling of safeguarding information

• Phishing and email security

• Incident reporting procedures

Training will be refreshed regularly.

Monitoring & Review

This policy will be reviewed:

• Annually as a minimum

• Following major incidents

• Following legal or regulatory changes

• Following ICO guidance updates

• Following cyber security risks or audit findings

This policy reflects UK legal and safeguarding expectations applicable during 2026.

Policy Approval

Approved By : Andrew Marr Date 29.05.2026

Review Information

Item Data Breach and Incident policy Date 29.05.2026

Policy Review Date 29.05.2026

Next Review Date 29.06.2027

Contact Information

For questions relating to this policy or to report a data breach, contact:

Nurture Education

Data Protection Lead: _Andrew Marr

Email: _ andrew@nurtureeducation.co.uk

Environmental Impact & Carbon Reduction Policy

Approved by: Andrew Marr

Date: June 2026

Next Review: June 2027

1. Purpose of This Policy

Nurture Education is committed to reducing our environmental impact and contributing to the

UK’s transition to a low-carbon economy. This policy outlines our approach to sustainability,

carbon reduction, responsible resource use, and environmentally conscious business

operations.

Our commitments align with national carbon-reduction targets, the Public Services (Social

Value) Act, and the expectations of schools, trusts, and public-sector frameworks.

2. Scope

This policy applies to:

• All Nurture Education employees

• All co-working office locations

• All recruitment, placement, and operational activities

• All digital systems and supply-chain partners

3. Our Environmental Commitments

Nurture Education commits to:

• Reducing carbon emissions across all business operations

• Minimising waste and promoting sustainable resource use

• Encouraging low-carbon travel and remote working

• Working with environmentally responsible suppliers

• Supporting schools in reducing their own environmental impact

4. Carbon Reduction Plan

Nurture Education has implemented a structured Carbon Reduction Plan built around four

pillars:

4.1 Low-Carbon Workspaces

We operate from co-working spaces that are committed to carbon-reduction initiatives,

including:

• Renewable-energy powered buildings

• Energy-efficient lighting and heating

• Waste-reduction and recycling schemes

• Shared resources to reduce environmental footprint

This significantly reduces the carbon impact associated with traditional leased offices.

4.2 Hybrid Working Model

To reduce commuting emissions, Nurture Education staff work:

• 2 days per week from home

• 3 days per week in co-working spaces

This hybrid model reduces:

• Carbon emissions from travel

• Office energy consumption

• Resource usage (heating, lighting, water)

4.3 Low-Carbon Candidate Deployment

We actively reduce travel emissions by:

• Placing candidates as close to home as possible

• Prioritising local schools for supply staff

• Using postcode-based matching to minimise travel distance

• Encouraging public transport, cycling, and walking

This reduces carbon output and improves candidate wellbeing.

4.4 Digital-First Operations

We minimise paper and physical resource use by:

• Using digital compliance packs

• Digital timesheets and invoicing

• Online safeguarding and compliance training

• Cloud-based document storage

• E-signatures for contracts and onboarding

This reduces printing, paper waste, and physical storage requirements.

5. Additional Environmental Initiatives

To strengthen our environmental performance, Nurture Education also commits to:

5.1 Sustainable Procurement

We prioritise suppliers who demonstrate:

• Low-carbon operations

• Ethical sourcing

• Environmental certifications

• Reduced packaging

5.2 Waste Reduction

We minimise waste through:

• Recycling in all co-working spaces

• Zero single-use plastic in office environments

• Reusable office supplies

• Responsible disposal of electronic equipment

5.3 Energy Efficiency

We reduce energy consumption by:

• Using energy-efficient devices

• Automatic power-saving settings

• Encouraging staff to switch off equipment when not in use

5.4 Staff Engagement

We promote environmental awareness through:

• Internal sustainability briefings

• Encouraging low-carbon commuting

• Sharing best practice on home-office energy efficiency

5.5 Carbon-Conscious Travel Policy

We reduce travel emissions by:

• Minimising unnecessary travel

• Using video meetings as default

• Encouraging public transport over car use

• Supporting cycle-to-work schemes

6. Measuring & Reporting Environmental Impact

We track and review:

• Carbon emissions from travel

• Office energy usage

• Waste and recycling levels

• Supplier environmental performance

• Progress against carbon-reduction targets

Annual reviews ensure continuous improvement.

7. Governance & Accountability

Environmental responsibility is overseen by:

• Operations Director – strategic oversight

• Office Manager – monitoring and reporting

• All staff – responsible for day-to-day environmental behaviours

8. Continuous Improvement

We commit to:

• Reviewing this policy annually

• Updating our Carbon Reduction Plan in line with UK government targets

• Exploring new technologies and practices that reduce environmental impact

• Working with schools to support their sustainability goals