Two activities, nine documents to create.

1Describe it
2Records needed
3Review and confirm
What you said

“A supplier sent us a batch of test data with real patient names in it.”

Process type
Supplier nonconformance
Logged by
Zak
Standards
ISO 13485 7.4ISO 27001 A.5.19UK GDPR
Records this needs
Supplier Nonconformance RecordISO 13485 · from template
Data Breach AssessmentUK GDPR · from template
Supplier Evaluation updateUpdates the supplier record in Network
This may be a personal data breach. The data breach response workflow starts the 72-hour ICO clock and assigns the DPO. Start it instead

Qyro’s suggestion is a starting point. Check the process type and records before you confirm.