Incident statuses — configurable status labels for the incident lifecycle
Last updated: October 20, 2026 by Steve
Incident Statuses
Incident statuses are the labels a privacy incident carries as it moves through its lifecycle. The stages — Active, In Review, and Closed — are fixed, but you configure the status labels within them. One special status, Contained, unlocks a one-click suggestion on the incident once containment is confirmed.
Where to Find It
Open Settings from the app toolbar and choose Incident statuses in the Incidents & complaints group. This group is visible only to users who hold the relevant privacy configure permission.
Stages and Status Labels
| Stage | What it represents | Example statuses |
|---|---|---|
| Active | The incident is being worked — facts, containment, harm, notifications. | New, In progress, Contained |
| In Review | A sign-off workflow is running, or the risk-of-harm determination has been recorded. | Under review |
| Closed | The incident is resolved. | Closed |
| Field | Details |
|---|---|
| Label | The status name, translatable across your active languages. |
| Stage | The lifecycle stage the status belongs to. |
How It Affects Incidents
- Same-stage status changes are a quick dropdown in the Overview sidebar; cross-stage moves use Advance.
- The compact lifecycle rail shows Active → In Review → Closed. In Review is reached by starting a review or recording the risk-of-harm determination, and stays checked even if a review returns the incident to Active.
- If you configure a status named Contained, a one-click Set status to Contained suggestion appears on the Containment tab after a user switches on Containment confirmed. Without such a status, containment is still confirmed — the shortcut simply does not appear.
Best Practice
Add a Contained status if your office wants the post-containment shortcut. It is optional, but it saves a manual status change at the moment staff confirm the breach has been stopped.