Register of incidents: stages and deadlines
A register of incidents is the internal log an organisation keeps from the moment a security event touching data is detected until the file is closed. For a straightforward event the cycle runs five to seven working days. The register records the trigger, the steps taken, the people who signed off each step, and the evidence kept for later review.
What opens the register
An entry opens the moment someone inside the organisation flags an event that could affect the confidentiality, availability or integrity of data. The trigger can be a system alert, a report from a staff member, or a notice from a supplier. The register does not wait for confirmation that the event is serious. It opens on suspicion and closes once the assessment is complete.
The duty to keep such a log follows from the security framework applicable to the organisation's sector. The framework does not prescribe a single template. It fixes the outcome the register must produce: a traceable account of what happened, when it was noticed, and who decided what.
Stages and typical timing
The table below sets out the stages most registers go through, with the interval that is realistic for each one.
| Stage | Typical duration | Who owns it |
|---|---|---|
| Detection and first entry | same day | whoever finds the event |
| Initial triage | 1 working day | security lead |
| Impact assessment | 1–3 working days | security lead with legal counsel |
| Notification decision | 1 working day | data protection lead |
| External notification, if triggered | set by the applicable deadline | data protection lead |
| Closure and sign-off | 1 working day | management representative |
The triage stage decides everything that follows. If triage classifies the event as low-impact, the file closes with an internal note. If triage flags a possible risk to individuals, the clock for a notification decision starts running from the moment the organisation became aware, not from the moment triage finished.
What to do
- The person who spots the event opens an entry in the register immediately, with a timestamp.
- The security lead runs triage within one working day and records the classification.
- Legal counsel reviews whether the event meets the threshold for external notification.
- The data protection lead documents the notification decision, whichever way it goes.
- If notification is due, the data protection lead sends it and logs the confirmation.
- Management signs off the closed entry and the register moves to archive.
A separate but related question is who signs off changes to the systems involved once the incident is closed. That question is covered step by step in Change control procedure: stages and deadlines, and the two procedures share a decision-maker in most organisations.
Who decides
Inside the organisation, the data protection lead or an equivalent role decides whether an event crosses the notification threshold. This is a documented decision, not a formality. Outside the organisation, if notification is due, the forum is the supervisory authority with jurisdiction over the affected individuals, and the deadline runs from awareness, not from the closure of the internal file.
Where a vendor caused the event, the decision on whether the vendor's own reporting duty has been triggered belongs to the vendor, but the organisation's register still records what it knew and when. Field-of-use terms in a licence sometimes set out who reports what; that drafting question is worked through in Field-of-use drafting: stages and deadlines.
If your case is different
If the event involves individuals in more than one member state, the register still opens the same way, but the notification decision needs input from counsel familiar with each jurisdiction involved, and the timeline tightens accordingly.
If a third party is involved and the third party disputes that an incident occurred, the register keeps running on the organisation's own timeline. A dispute from the other side does not pause the internal deadline; it only adds a second track of correspondence to the file.
If the event turns out to be a near-miss with no actual exposure, the register still closes with a written entry. A near-miss with no entry is the most common gap found in later reviews.
A different kind of deadline question, tied to a fixed offer rather than an incident, is set out in The deadline that matters in this situation in detail, for readers comparing how strict windows are calculated across unrelated procedures.
What this page does not decide
This page does not decide whether a specific event meets the threshold for external notification. That call depends on facts particular to the event and to the individuals affected, and it is made by the data protection lead with legal input, not by a general procedure. This page also does not set out what evidence a decision-maker will accept later if the incident is challenged; that is a separate question, worked through in Reserve evidence and attestation step by step in practice, which covers the same evidentiary logic in a different setting.
Verified
Checked against publicly available guidance published by data protection supervisory authorities on incident handling and internal record-keeping. Reviewed against sector security frameworks addressed to organisations operating in the EU, including the obligations discussed in Data, security and AI obligations in practice. Last checked: current publication cycle.
Related reading
Readers who reach this page from a supervisory inspection rather than an internal detection should start with Supervisory inspection: stages and deadlines, which covers the external counterpart to the internal register described here.
FAQ
How long does register of incidents take in practice?
A straightforward entry closes in five to seven working days. An entry that triggers external notification runs on a shorter, fixed clock from the moment of awareness, and the internal steps compress to fit it.
Which documents are needed to start?
The trigger record, the triage note, and a short chronology of who knew what and when. Nothing else is required to open the file; the assessment and any notification are added as they happen.
What happens if the other side does not respond?
If a vendor or third party involved in the event does not respond to a request for information, the register records the request and the silence, and the organisation proceeds with the assessment on the information it has. Silence from the other side does not extend the organisation's own deadline.
Next step
Incident registers and contract terms often collide when the incident touches an AI system built on a supplier's output. That specific gap is addressed in When the contract is silent on AI output in.