When personal data goes to the wrong person, is lost, stolen or locked, or is reached by someone who should not have it, record it as an incident. Record it before you are sure of the details.
Who can do this
An owner, editor or contributor of your workspace can report an incident and work on it. Only an owner or editor can draft the notice to the Commission. A viewer can see the register.
Reporting a new incident needs a paid plan. On the free plan, incidents already recorded stay visible.
The 72-hour clock
You have seventy-two hours to tell the Commission, or to record why you need not. The clock runs from the moment somebody in your organisation became aware. It does not run from when the incident happened, or from when it was written down in Asiri.
Deciding counts as answering. An incident with a written decision not to notify is finished with the clock. An incident with no decision is not, whatever its severity. Reporting late is not the same as not reporting, and the register keeps both facts.
Find the register
Open Records & controls → Incidents. The figures at the top are Still live, Past the window, Reported and Never reviewed, and the tabs filter the list the same way. The list is ordered by what the clock owes, not by date.
If an incident is past the window with nothing decided, a red notice at the top names it.
Report an incident
Press Report an incident. It is one page, so you can save before you know everything.
- Awareness: the date and time you first heard. If you are not sure of the minute, give the hour.
- Incident details: describe it In a sentence, then choose what happened, for example It went to the wrong person, Something was lost or Someone got in.
- Affected people: Roughly how many. An estimate is fine and can be corrected later.
- Affected groups: tick any that apply, such as Children are affected or Sensitive data was involved.
- Initial response: tick what you have already done.
- Notification decisions: for The Commission and for The people affected, choose Not decided yet, Yes — they have to be told or No — they do not. Any decision needs a reason. Not decided yet is the honest answer in the first hours.
Press Record the incident. The rail shows how many of the 72 hours remain. Press Open the incident.
On the incident
The incident page shows The statutory clock, when you Became aware, when notice is Due by, and the Severity.
Under Who has to be told there are two separate decisions: the Commission and the people affected. An incident can owe one and not the other. Only the Commission side has a clock, so the people side is the one most often left undone.
Related actions and details links the three steps:
- How bad is it? Choose People affected, tick the harm factors, and choose what to Treat as: Low, Medium, High or Critical. Asiri scores the factors. If your choice overrides the score, a reason is required. Press Record severity.
- The notification. Under Draft the notice, fill in the five required sections: the nature of the breach, the people and data categories, the likely consequences, the measures taken, and the data protection contact. If you are past the window, explain the delay. Press Save notice draft.
- The tracker. See whether the notice is drafted or filed, link the people affected, and tell them.
A saved notice is not edited. If a fact changes, draft a new notice and say what changed. Both stay on record.
Tell the Commission
A draft is not a notification. Asiri does not send the notice to the Commission for you. Send it yourself, the way the Commission asks for it.
To record that it was sent, or to move the incident on, use History and corrections at the foot of the incident's page. Each change asks for a reason and is kept in the incident's history.
An incident cannot be closed while either decision is undecided.
Tell the people affected
On the tracker:
- Under The people it affected, press Link affected people. Enter their references from the people register, up to two hundred at once, and say Why these people. Each person shows whether the register holds an address for them.
- Under Tell the people affected, fill in How long the exposure lasted, What was not exposed and Where the reader goes to act. What was exposed, the likely consequences and the measures taken come from your notice, so a notice must be drafted first.
- Press Review the send, read What this will do, and send it.
The letter goes out in your workspace's name and cannot be recalled. People with no address on file do not receive it, and the record says so. The send is recorded on the audit trail. Asiri does not keep a list of who received it by name.
Common questions
"Do we have to wait until we know what happened?" No. Record it now. "We were still investigating" does not stop the clock.
"Does Asiri file the notice with the Commission?" No. It drafts the notice with the five things the Commission asks for. You send it.
"Can we still record incidents if our bill is unpaid?" Yes. Incidents and the other statutory registers stay writable when a workspace is read-only.