Document preservation

You should take immediate steps to ensure that you preserve all documents relating to the information breach, including those relating to all employees concerned. Points to bear in mind include:

  • the extent to which it is possible to request that all employees – or all relevant employees – take steps to ensure that all documents are preserved will depend on the extent to which the information breach is confidential within your business
  • to the extent that employees are told to preserve documents in relation to the information breach, ensure they are aware of the importance of confidentiality in relation to the information breach
  • the IT members of the incident management team should ensure that routine document destruction procedures that would otherwise apply to documents related to the information breach (and all employees associated with the breach) are suspended. This should apply equally to routine email and word-processing archiving and deletion processes, as well as to hard copy material