19 Online Safety Incident and Breach Handling Procedure

Purpose

This procedure defines what to do when there is an online safety incident or a breach of the school's online safety and recording privacy rules, including:

• recorded lessons being shared;
• unauthorised screenshots or screen recordings;
• account misuse;
• harmful content or bullying in group chat;
• access to recordings by people who should not have it;
• data or privacy breaches.

Scope

It applies to incidents involving pupils, staff and school systems or platforms, during live lessons and in recordings that only pupils may access.

Immediate actions: first response

Classification of incidents

High-severity incident: a recording privacy breach

Where recordings are accessed or shared in a way that suggests unauthorised viewing, including exposure beyond pupil-only access, the school will:

• secure access immediately, by locking or revoking access for the affected accounts, restricting the recording where possible, and investigating how the access happened;
• refer to the Designated Safeguarding Lead without delay, because the breach may indicate bullying, coercion or harmful intent;
• investigate the incident by reviewing platform logs and the pupil accounts involved, and documenting what happened, when, and how far it spread;
• contact only the responsible adults internally whose involvement is required for safeguarding actions; parents are not given recording links or access that would bypass pupil-only controls;
• apply behaviour sanctions and online safety consequences in line with the Behaviour Policy and the Online Safety Policy;
• remediate the weakness by updating permissions, access rules and moderation settings, and by giving pupils targeted reminders.

Investigation procedure

The Designated Safeguarding Lead or the Online Safety Lead will:

• gather evidence and build a timeline;
• identify the pupils and accounts affected;
• interview staff or pupils where that is appropriate and safe;
• record the findings and the decisions taken.

Outcomes and reporting

The school documents the incident summary, the actions taken, whether a safeguarding referral was made, and the corrective actions that will prevent a recurrence.

Review and learning

After an incident is resolved, the school reviews whether the rules and controls in place were adequate, and whether training, moderation or access controls need strengthening.

Review

This procedure is reviewed at least once a year and after any major online safety incident.