Confidentiality incident register template
Every incident goes in it, including those that do not present a risk of serious injury. The Commission can ask for a copy.
A confidentiality incident is unauthorized access, use or communication, or the loss of personal information. The private-sector register records every incident. The entries are kept up to date for at least five years after the date, or the period, when the organization became aware of the incident.
One row per incident
Register columns
Number: 1. Personal information involved (or why a description is impossible): 2. Circumstances, in brief: 3. Date or period of the incident (or why it is unknown): 4. Date or period the organization became aware: 5. Number of persons concerned (or an approximation): 6. Risk of serious injury: yes or no. Sensitivity of the information: Possible malicious uses: Anticipated consequences: Likelihood of a harmful use: 7. If the risk is serious: date of the notice to the Commission, date of the notice to the persons. Public notice: yes or no, and the reason if one was given. 8. Measures taken to reduce the risk of injury:
When the assessment finds a risk of serious injury, the enterprise promptly notifies the Commission d'accès à l'information and the persons concerned. The decision itself is covered in the reporting guide.
The format is not imposed. The content is. Adapt the columns to your tool, and keep the record for at least five years.
A register you can hand over
CapPRP keeps incidents, the risk assessment and the notice dates in one place.