Incident types — categories for privacy incidents, each carrying a governing legal authority
Last updated: October 20, 2026 by Steve
Incident Types
Incident types are the categories a privacy incident or breach can be filed under. Each type carries a governing legal authority — the Act or regulation that applies — and that authority is required before an incident of that type can be reported, because it is what drives the notification-obligations calculator later in the record.
Where to Find It
Open Settings from the app toolbar and choose Incident types in the Incidents & complaints group. This group is visible only to users who hold the relevant privacy configure permission.
The List
Incident types use the shared Settings list. Click a row to open a read-only view of its settings, and use Edit in the footer, or the pencil on the row, to open the form. The bin deletes a row you added; a built-in row, or one delivered by a jurisdiction pack, shows the bin greyed out with the reason, so turn it off with Enabled instead. Drag a row (or press Alt+Up / Alt+Down, or use the move arrows) to set the order the lists and pickers show; only the position is saved. The list shows the Legal authority of each type.
Options and Fields
| Field | What it controls |
|---|---|
| Name and description | The type's label, translatable across your active languages. |
| Governing legal authority | The legal authority (Act or regulation) that governs incidents of this type. Required — an incident of this type cannot be reported until the type is mapped to one. |
How It Affects Incidents
- On the Report incident dialog, staff pick a type when more than one is configured; the type's governing authority then shows as a read-only field.
- If the chosen type has no governing authority, a warning appears and the incident cannot be submitted until an administrator maps the type to a legal authority.
- The governing authority feeds the Notifications tab: the obligations calculator produces its statutory notices from the incident's legal authority, and voluntary notification types are scoped to that same authority.
Best Practice
Map every incident type to a legal authority before staff start reporting. An unmapped type blocks reporting outright, and the mapping is what lets the notification calculator tell your office who must be told and by when.
Retention
Each incident type carries a retention period (months) that governs when its closed incidents become eligible for disposition, measured from the closed date. Blank means keep indefinitely (the default). See Retention Review.