Data Security Standard 7 - Continuity planning
This guidance relates to the 2023-24 (version 6) standard.
Overview
A continuity plan is in place to respond to threats to data security, including significant data breaches or near misses, and it is tested once a year as a minimum, with a report to senior management.
Standard 7, National Data Guardian (NDG) review
A business continuity exercise is run every year as a minimum, with guidance and templates available from the toolkit.
Those in key roles will receive dedicated training, so as to make judicious use of the available materials, ensuring that planning is modelled around the needs of their own business.
There should be a clear focus on enabling senior management to make good decisions, and this requires genuine understanding of the topic, as well as the good use of plain English.
Please refer to further note on professional judgement, auditing and UK GDPR.
Last edited: 8 October 2025 2:00 pm