Nottingham Trust's dates, drawn to scaleNottingham Trust's dates
A dated timeline of the Trust's own account, from the attacks on 13 June 2023 to 1 January 2027, the earliest that the Trust's phrase early next year can mean. It is drawn to scale and every day count is derived. Hover, tap or focus any marker for the exact words and the source.
13 dates, in order, from 13 June 2023 to 1 January 2027
13 June 2023 (Tuesday): The attacks.
One factual line, from the Inquiry's own page. The Trust says all six were admitted to its emergency department.
The Nottingham Inquiry, home page, read 18 October 2026: “killed three people and seriously injured three other people in Nottingham city centre”
The Trust, first witness statement to the Nottingham Inquiry (WITN0226001), dated 5 December 2025, paragraph 4: “These individuals were all admitted to the Queens Medical Centre Emergency Department and variously treated” The Trust's own account to the Inquiry, not an Inquiry finding.
Every day count on this timeline is counted from this date (derived).
Not stated: any detail of the attacks. This timeline gives one line and no more.
4 October 2024 (Friday): First audit request.
Another NHS trust asks the Trust for audit data, after the families' legal representatives asked who had accessed the records. The Trust says this is when it became aware of any suggested unauthorised access.
The Trust, first witness statement to the Nottingham Inquiry (WITN0226001), dated 5 December 2025, paragraph 151: “submitted a request to the Trust, via their respective Data Protection Offices, for systems audit data” The Trust's own account to the Inquiry, not an Inquiry finding.
The Trust, first witness statement to the Nottingham Inquiry (WITN0226001), dated 5 December 2025, paragraph 17: “did not become aware of any suggested unauthorised access until early October 2024” The Trust's own account to the Inquiry, not an Inquiry finding.
13 June 2023 to 4 October 2024 is 479 days (derived).
Not stated: what prompted the Trust's inquiries, on the Trust's October 2026 page. Its evidence to the Inquiry describes this request.
10 February 2025 (Monday): Audit reports.
The Trust's digital services team produces audit reports for the records of the three people who died.
The Trust, first witness statement to the Nottingham Inquiry (WITN0226001), dated 5 December 2025, paragraph 161: “The audit reports were provided by the Trust's Digital Services team on 10 February 2025” The Trust's own account to the Inquiry, not an Inquiry finding.
Day 608 is 129 days after the first audit request (derived).
Not stated: the steps between the request and the reports. The Trust's evidence tells them in paragraphs 152 to 160, and this timeline does not draw them.
12 February 2025 (Wednesday): Report to ICO.
The Caldicott Guardian screens the audit data and reports a potential breach to the Information Commissioner's Office through the Data Security and Protection Toolkit. The words quoted are the Trust's description of its own report.
The Trust, first witness statement to the Nottingham Inquiry (WITN0226001), dated 5 December 2025, paragraph 167: “in the order of 20 to 30 likely inappropriate access events” The Trust's own account to the Inquiry, not an Inquiry finding.
Day 610 is 131 days after the first audit request (derived).
Not stated: what the ICO itself says about this report.
13 February 2025 (Thursday): Command group.
A meeting of the Trust Executive Team and the Caldicott Guardian sets up a group to handle the incident.
The Trust, first witness statement to the Nottingham Inquiry (WITN0226001), dated 5 December 2025, paragraph 169: “an Incident Command Group was established to meet on a regular basis in respect of this incident” The Trust's own account to the Inquiry, not an Inquiry finding.
Day 611 is 1 day after the report to the ICO (derived).
Not stated: the group's decisions. This timeline gives its start date only.
20 February 2025 (Thursday): Letters to families.
Duty of candour letters go to the families of the three people who died. The Trust also says it reported to the General Medical Council the same day (paragraph 185).
The Trust, first witness statement to the Nottingham Inquiry (WITN0226001), dated 5 December 2025, paragraph 180: “The duty of candour letters was sent on 20 February 2025” The Trust's own account to the Inquiry, not an Inquiry finding.
Day 618 is 7 days after the command group was set up (derived).
Not stated: what the GMC did with the report.
21 February 2025 (Friday): ICO replies.
The Trust describes the ICO's reply to its first notification. The reason it gives is that UK GDPR applies only to living individuals.
The Trust, first witness statement to the Nottingham Inquiry (WITN0226001), dated 5 December 2025, paragraph 186: “no further action was necessary on the part of the ICO in relation to the notified breach” “the UK GDPR applying only to identifiable living individuals” The Trust's own account to the Inquiry, not an Inquiry finding.
Day 619 is 11 days after the audit reports of 10 February (derived).
Not stated: the ICO's own words. The Trust describes the reply.
10 July 2025 (Thursday): Staff campaign.
The Trust's campaign on staff responsibility for patient privacy starts.
The Trust, first witness statement to the Nottingham Inquiry (WITN0226001), dated 5 December 2025, paragraph 242: “The campaign commenced on 10 July 2025” The Trust's own account to the Inquiry, not an Inquiry finding.
Day 758 is 139 days after the ICO's reply of 21 February 2025 (derived).
Not stated: what the campaign changed in how staff open records. This timeline gives its start date only.
28 October 2025 (Tuesday): Wider audit.
The Trust decides to audit the five systems it had audited in February again, and to add four more.
The Trust, third witness statement to the Nottingham Inquiry (WITN0406067), dated 5 May 2026, paragraph 23: “On 28 October 2025 a decision was then taken to extract further data from additional systems operated by the Trust” The Trust's own account to the Inquiry, not an Inquiry finding.
Day 868 is 110 days after the staff campaign began (derived).
Not stated: how many more people the wider audit brought in. The Trust does not say whether its groups overlap, so none are added here.
27 January 2026 (Tuesday): Funding agreed.
The Chief Executive's Team supports a more proactive approach to monitoring access to patient records. The Trust names the product it agrees to procure to the Inquiry.
The Trust, third witness statement to the Nottingham Inquiry (WITN0406067), dated 5 May 2026, paragraph 47: “A decision was made on 27 January 2026 and funding agreed” The Trust's own account to the Inquiry, not an Inquiry finding.
The Trust, second witness statement to the Nottingham Inquiry (WITN0406001), dated 19 February 2026, paragraph 71: “a decision was made to support the approach, with funding agreed for a digital system to collect data on access to records” The Trust's own account to the Inquiry, not an Inquiry finding.
Day 959 is 91 days after the wider audit decision (derived).
Not stated: whether the system now in testing is the product the Trust named to the Inquiry.
21 May 2026 (Thursday): First outcomes.
The Trust's news page says 11 members of staff are dismissed and a further 14 have had actions taken against them. The bar above this marker draws the outcomes it lists.
NUH, statement posted 21 May 2026, 09:56: “11 members of staff have been dismissed and a further 14 have had actions taken against them” “Further investigations are ongoing”
Day 1,073 is 114 days after the funding decision (derived).
Not stated: when the dismissals took place. The page gives the date it was posted.
16 October 2026 (Friday): More dismissals.
The Trust's news page adds dismissals, and says testing of a new monitoring system is underway, followed by a pilot period. The bar above this marker draws its table of outcomes.
NUH, statement posted 16 October 2026, 12:25: “This now brings the total number of dismissals as part of the investigation to 15” “Testing on the system is currently underway, followed by a pilot period”
Day 1,221 is 3 years, 4 months and 3 days after the attacks (derived). Day 1,221 is 148 days after the statement of 21 May 2026 (derived).
Not stated: how many people the outcomes cover.
Early next year: Aim, not a date.
The Trust's page gives no date. The marker is hollow and dashed because 1 January 2027 is only the earliest that early next year can mean.
NUH, statement posted 16 October 2026, 12:25: “with the aim of going live early next year”
At least 1,298 days after the attacks, at least 339 after the funding decision of 27 January 2026 and at least 688 after the report to the ICO of 12 February 2025 (derived). At least 77 days after the statement of 16 October 2026 (derived).
Not stated: a go live date, who reviews the alerts, or whether it is the product the Trust named to the Inquiry.
On the main axis these dates are too close to tell apart, so the inset draws the 12 days to scale. Each date has its own marker. 10 to 21 February 2025 is days 608 to 619 after the attacks (derived).
Days between dates (derived)
- 13 June 2023 to 4 October 2024: 479 days (derived).
- 4 October 2024 to 10 February 2025: 129 days (derived).
- 21 February 2025 to 10 July 2025: 139 days (derived).
- 10 July 2025 to 28 October 2025: 110 days (derived).
- 28 October 2025 to 27 January 2026: 91 days (derived).
- 27 January 2026 to 21 May 2026: 114 days (derived).
- 21 May 2026 to 16 October 2026: 148 days (derived).
- 16 October 2026 to early next year, drawn at 1 January 2027: at least 77 days (derived).
- At least 688 days (derived): from the ICO report of 12 February 2025. 12 February 2025 is the Trust's date for reporting a potential breach to the ICO. 1 January 2027 is the earliest the Trust's early next year can mean, so the interval is at least this long. The go live is an aim, not a date.
- At least 339 days (derived): from the funding of 27 January 2026. 27 January 2026 is the Trust's date for the decision and the funding. 1 January 2027 is the earliest the Trust's early next year can mean, so the interval is at least this long. The go live is an aim, not a date.
| Outcome | 21 May 2026 | 16 October 2026 |
|---|---|---|
| Dismissal | 11 | 15 |
| Final written warning | 12 | 15 |
| First written warning | 2 | 2 |
| No case to answer | not listed | 2 |
| Total (derived) | 25 | 34 (32 with an action) |
Not stated in the record
- How many people the 34 hearing outcomes cover.
- How many records were opened, or over what period.
- Who or what first found the access: the October page does not say.
- Any ICO, police, NMC or GMC decision on the people involved.
- Whether the system in testing is the product named to the Inquiry.
- A go live date, who reviews the alerts, or any appeal.
No victim, family member or member of staff is named. Dates before 21 May 2026, other than the attacks, are the Trust's own account to the Nottingham Inquiry, not Inquiry findings. Hover, tap or focus a marker for the words and source.
Derived means this site's arithmetic.