Incidents
Incident register
Record every personal data breach, assess the risk, see who to notify and by when in the countries you serve, and export the register.
A personal data breach is any incident that exposes, changes or loses personal data: an email sent to the wrong person, a lost laptop, a hacked account, a deleted database. Most privacy laws ask you to record every breach, even the ones you do not have to notify. The Incidents page is that register.
#Record an incident
Open Incidents and choose Record an incident. Describe what happened, when you discovered it, the data and the people affected, the likely consequences and the measures you took. Then assess the risk:
| Risk | What it means | What to do |
|---|---|---|
| Not assessed | You have not decided yet | Assess it quickly: deadlines start when you become aware of the incident |
| No risk | Unlikely to harm anyone, for example encrypted data with the key kept safe | Record it. No notification in most countries |
| Risk | May harm the people concerned | Notify the authority |
| High risk | Likely to cause serious harm: identity theft, financial loss, discrimination | Notify the authority and the people concerned |
#Who to notify, and by when
When the risk is set to Risk or High risk, the incident shows the rules of the countries you serve (see Countries with their own privacy law):
| Where | Authority | Deadline |
|---|---|---|
| Europe (GDPR) | Your lead data protection authority | 72 hours after becoming aware |
| United Kingdom | ICO | 72 hours |
| Switzerland | FDPIC | As soon as possible, when the risk is high |
| Canada | OPC, and the CAI in Québec | As soon as feasible |
| Brazil | ANPD | 3 business days |
| Chile | Personal Data Protection Agency | Without undue delay |
| Australia | OAIC | Assess within 30 days, then as soon as practicable |
| United States | Some state Attorneys General | Set by each state |
The register shows the 72-hour GDPR deadline on each incident to notify, and warns you when it has passed. Record the date you notified the authority and the people concerned.
#Export
Export gives the register as a PDF or an Excel file, for an authority, an auditor or your own files.
#FAQ
#Should I record an incident I do not notify?
Yes. The register must contain every breach, with the facts, the effects and what you did. Note why you decided not to notify.
#Is the register public?
No. It stays in your workspace and is never shown in your privacy center.
#Does Privacyboard notify the authority for me?
No. Each authority has its own form. The register tells you who to notify and keeps the dates and details you need.
Privacyboard is a guidance tool, not legal advice. This page describes what the product does today. Found something unclear or out of date? Write to antoine@unmake.io.