Responsible escalation
Raise concerns using evidence, proportionate action and accountable channels.
Covered in this guide
- Separate observation from allegation.
- Protect people and preserve relevant evidence.
- Use emergency and ordinary escalation appropriately.
Escalation should not exaggerate an uncertain concern, but silence can allow harm to continue. Record what was observed, the immediate risk and the appropriate responsible recipient.
Escalate observations, not accusations
Escalation should not exaggerate an uncertain concern, but silence can allow harm to continue. Record what was observed, the immediate risk and the appropriate responsible recipient.
A rumour that skipped the accountable channel
A team member notices that a shared report contains hidden personal data. It is unclear whether anyone outside the team downloaded it.
Try this
Set out the immediate steps.
Review answer guidance
Restrict access without destroying evidence, notify the privacy or security lead, record who had access and when, preserve audit logs, and avoid unsupported claims about misuse while the incident is assessed.
Proportionate action in the task
Record what you observed, use the named channel, and keep the language at the level of evidence. Escalation is not a finding.