Creating Incidents

Reporting an incident is intentionally low-friction so front-line staff can log a privacy breach or security incident quickly, then refine it later. You need the incident-report permission. From the Incidents dashboard, choose Report incident to open the dialog. Nothing you enter here is final — every field can be edited in the incident detail panel after the record is created.

Reporting an Incident

1. Pick an Incident type if more than one is configured. The type carries a governing authority — the Act or regulation that applies — shown as a read-only field. If the chosen type has no governing authority — the Universal baseline's breach type, until a jurisdiction pack or an administrator sets one in Settings → Incident types — a note names the type and you can still report: the incident is recorded under No specific law, and the notification calculator applies only the rules that hold under every law (no statutory notification deadlines). Setting the law on the type later affects new incidents only.
2. Enter a Title (required) and an optional Description.
3. Set Discovered on. It defaults to today and cannot be a future date.
4. Optionally choose a Cause from the configured taxonomy, and add a free-text Cause / circumstances narrative describing what happened.
5. Optionally link a Privacy subject (the reusable record or system the incident concerns), enter the number of affected individuals, and select the categories of personal information involved. If the chosen subject has a pre-agreed escalation plan, it appears right in the dialog — contact first, plan text below — and later as a banner on the open incident.
6. Select Report incident to save.

The incident is created in the first lifecycle stage (Active) and opens in the detail panel, where the deeper work is done.

The Governing Authority

An incident's statutory notification obligations are calculated from its legal authority. The governing authority comes from the incident type, not from a field you fill in. If the type has none, the dialog tells you and still lets you report: the incident is recorded under No specific law and has no statutory notification deadlines until the law is set. Choose a different type, or ask an administrator to set the law on the type (see Incident Types).

Incidents Reported Through the Portal

A member of the public or an employee can report a privacy concern through your public portal. A portal form registers in one register, chosen when the form is created — the Privacy concern report template registers in Incidents. The report waits in the Portal Inbox, where it carries a pill. Register incident asks only for the incident type (blank uses the Breach incident type) and an assignee. The narrative and attachments come from the submission, and the original is filed as the incident's first document; the reporter's name and contact details live only there, never in the description. Registering needs the register's own intake permission on top of portal triage. See Public Portal for setting the form up.

Linking a Subject from the Inventory

When you start from a subject's Incident history tab and choose Create incident, the report dialog opens with that privacy subject already linked to the new incident.