Crisis and incident management

The risk of serious injury

When an incident occurs, the RPRP assesses whether it presents a risk of serious injury based on:

1. the sensitivity of the information concerned;
2. the anticipated consequences of its use;
3. the likelihood it will be used for harmful purposes.

If the risk is serious

• notify the CAI and the affected individuals, promptly;
• take reasonable measures to reduce risks and prevent a similar incident;
• enter the incident in the register (in all cases, serious or not), kept 5 years and provided to the CAI on request (s. 3.5 to 3.8).

Roles during a crisis

SaaS good practice: set an internal maximum of 4 h between detection and alerting leadership and the RPRP, and prepare notice templates in advance (see the toolbox).