School documents · Pack 2026-08-29
Personal data breach process
How Five Wells notifies a school and what the school should do.
- Who it is for
- DPOs and headteachers
- How to access it
- Public. Actual incident reports for a named school are not published.
This pack describes how Five Wells Education designs and operates the platform so schools can complete their own due diligence. It is not legal advice. The school remains the data controller for pupil and staff data it places in the product. A solicitor or DPO should review processing before go-live.
If Five Wells detects a breach
If Five Wells becomes aware of a personal data breach affecting a school tenant, it will notify that school’s primary contact without undue delay, with facts then known: nature of the breach, categories of data, likely consequences, and measures taken or proposed.
If the school detects a breach
- Revoke access (suspend staff account, rotate leaderboard token, reset PINs) using in-product tools where possible.
- Contact Five Wells via in-app Support or the school’s known support channel.
- The school remains responsible for ICO notification decisions (72-hour assessment) as controller.
Do not
- Post incident details on social media.
- Email full class lists to a personal Gmail “just in case” without following the school’s own breach policy.
Related: All school documents · Roster field inventory