Privacy · Incident Management

When to open a breach record

Open one as soon as you have reasonable certainty that a confidentiality, integrity or availability event involving personal data has occurred. Don't wait for investigation to complete — the 72-hour (GDPR / DPDP) and 60-day (HIPAA) clocks run from awareness, not from confirmation.

Step-by-step

  1. Privacy → Incidents → New. Select the regulator scope (GDPR, HIPAA, DPDP, CCPA…). iCompaas pre-loads the applicable timelines.
  2. Classify the breach: confidentiality, integrity, availability (or a combination). Estimate data subject count and categories of personal data.
  3. Containment evidence — paste tickets, change records or chat threads. Everything is timestamp-locked.
  4. Run the risk assessment — built-in 4-factor for HIPAA, "likely to result in high risk" assessment for GDPR. The outputs determine whether individual notification is required.
  5. Draft notifications — the workflow pre-fills the Supervisory Authority report and the individual-notice email per regulator from the case data.
  6. Reviewer sign-off — required Legal/Privacy approver before any external send. Approvals are recorded with timestamp and the version reviewed.

Reporting

At quarter-end the Privacy module produces a breach register summarising opened, contained, notified, and closed incidents — the format auditors expect under SOC 2 Privacy, ISO 27701 and GDPR Article 30.