Task guide
Incidents and data breaches
Report an incident the moment it is known, assess it, decide and record the notices the Data Protection Act asks for within their clocks, and close it once every action is done.
A lost laptop, an email sent to the wrong person, a break-in: anyone may report one, and the compliance function handles it. Each is numbered (INC-2026-0001).
Report it
Choose New, Incident and give What happened, in a line, its Kind, when it Happened, when The firm knew, the Handler if you know who should have it, and What happened in full. The handler and whoever manages compliance are told.
If you cannot read the incidents register yourself, you are shown the incident's number once it is reported, and the handler takes it from there. A matter, client or complaint linked to an incident must be one you may open.
The clocks
From the moment the firm knew, two clocks run: one to tell the Data Protection Commission (Notify the Data Protection Commission within (hours), 72 as shipped) and one to tell the people affected (Notify the people affected within (days), three). The Data Protection Act, 2012 (Act 843) asks for both without undue delay; the firm's own lawyer confirms the periods against the Act and the Commission's guidance. A clock about to run out tells the handler and compliance.
Assess, decide, notify
- Assess: whether personal data is affected, which kinds, roughly how many people, the risk to them and the reasoning.
- On each of Data Protection Commission and People affected, Decide whether to notify. A decision that no notice is owed must give its reasoning.
- Record notice once it went: when, how, and the reference the Commission gave.
Where no personal data is affected, no notice is owed.
Actions, records and evidence
Add action sets what is done to contain it or stop it happening again, with an owner (who is told) and a due day; each is ticked Done or Waived with a reason. Link record names the matters, parties and people it touched and any complaint it relates to. Keep evidence keeps a document from the store, opened in the viewer.
Close it
Close is open once both notices are decided (or no personal data was affected) and every action is done or waived.
Was this helpful?
Read next
- Practice-risk categoriesKeep the registers undertakings, complaints, incidents and gifts are filed under, each in the firm's order, and say which kinds of undertaking a partner approves.
- ComplaintsRecord a client's complaint the day it arrives, answer it within the firm's time limits, close it with its outcome, redress and lessons, and read the figures.
- Data subject requestsLog, verify, locate and answer a request under the Data Protection Act, 2012 (Act 843), within the firm's time, with every step on the record.