Incident Management
Track privacy incidents from initial report through resolution. Manage response timelines, coordinate DPA notifications, and maintain a complete audit trail of every action taken.
Incident Lifecycle
Every incident follows a defined lifecycle. The system tracks status transitions and timestamps every change for compliance evidence.
Reported
Incident identified
Investigating
Gathering facts
Containment
Stopping the impact
Notification
Alerting authorities
Resolved
Incident closed
Severity Levels
Classify incidents by severity to prioritize response efforts and determine notification obligations.
LOW
Minor incident, no personal data at risk
MEDIUM
Limited exposure, contained quickly
HIGH
Significant data exposure, DPA notification likely
CRITICAL
Large-scale breach, immediate DPA notification required
DPA Notification
Under GDPR Article 33, personal data breaches must be reported to the supervisory authority within 72 hours of becoming aware of the breach. DPO Central tracks this deadline automatically.
When a breach is likely to result in a risk to the rights and freedoms of individuals, notify the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it. The system tracks this deadline from the moment the incident is reported and displays countdown timers on your dashboard.
Incident Dashboard
The incidents dashboard gives you an at-a-glance view of your organization's incident status.
12
Total Incidents
3
Open
1
Critical
1
Pending DPA
Incident Timeline
Every incident maintains a detailed timeline recording all events, status changes, communications, and actions. This provides the audit trail needed for regulatory compliance.
Example Timeline
Response Tasks
Assign response tasks to team members to coordinate the incident response. Track completion and ensure all remediation steps are carried out.
Reporting an Incident
Report the Incident
ReporterNavigate to the Incidents module and click 'Report Incident'. Provide initial details: title, description, severity, and affected systems.
Triage and Investigate
Privacy OfficerThe privacy officer reviews the report, assigns a severity level, and begins the investigation.
- •Determine scope: what data was affected and how many subjects
- •Identify root cause and attack vector if applicable
- •Assess whether DPA notification is required
Contain and Mitigate
IT TeamTake immediate action to contain the incident and prevent further data loss.
Notify Authorities
DPOIf required, submit DPA notification within 72 hours. Notify affected data subjects if the breach poses a high risk to their rights.
Resolve and Document
Privacy OfficerOnce the incident is fully resolved, document lessons learned, update policies, and close the incident record.