top of page

Safer Reporting of Data Breaches

An end-to-end trauma-informed review of how to report serious data breaches from domestic abuser survivors and people living with HIV.


Client: Information Comissioner's Office

Duration: 2 Months, 2024

Topic: Domestic Abuse, People Living with HIV, Data Breaches



The Brief

How can we redesign the complaints journey for when someone has experienced a particularly vulnerable data breach?


People who are living with HIV and domestic abuse survivors face particularly vulnerable situtations if their addresses or HIV statuses are leaked. Reporting this can be really challenging and it can be hard to know who to get advice from. The ICO recognised that they wanted to do something to better serve these communities and so commissioned an end-to-end service review.


Research and Methodology

I designed and conducted the following worklan for this project:


Phase 1: Designing a Set of Trauma-Informed principles for the ICO

A series of workshops to introduce the team to


Phase 2: End-To-End Journey Map and Review

A two week in-depth review of the whole website for reporting. adata breach, complete with elements which were particular pain points for those expereincing trauma. This was backed up with staff and quantative data from site visits. An initial set of hypothesis were drawn up.


Phase 3: Designing and Conducting Trauma-Informed Qualitative Research

In-depth 75 minute interviews with a range of service users who had experienced a data breach. The entire process, from recruiting to compensation was trauma informed and we did our best to be accessible as possible, for example changing the voucher incentive for one participant who was sheilding and could not leave the house to use their payment incentive. A variety of altrnative, more trauma-informed prototypes of the site and email communication were tested in A/B testing.


Phase 4: Synthesis and Recommendations

All of the findings were summaried into 12 insights, per each trauma principle. Through a series of two workshops and presentations, we ranked a series of recommendations by impact, feasibilty and quick wins. Final outputs were delivered through a research report and video presentation which can be reviewed afetr project roll off.


Key Insights

These insights are protected by NDA. Please contact Sophia if you are interested in a censored, sanitised version of these


The Team


  • Sophia Luu - Trauma-Informed Specialist

  • ICO PACE customer services team

  • Staff and Service users from The National Aids Trust,  Terrence Higgins Trust, Women’s Aid, Scottish Women’s Aid





  • Instagram
  • LinkedIn

© 2024 Sophia Luu

bottom of page