Incident · 05
Incidents & notification
Incidents are clocks. Contain and record first; PIPL essays come later.
First job Contain and record before treating the event as a general PIPL essay.
Start here
Key considerations
- What may have leaked, and when?
- Is containment underway?
- Who needs notice — internally, to individuals, to a regulator?
Decision map
Keep the question bounded.
- ContainStop ongoing exposure where you can.
- RecordTimeline, systems and categories — without dumping sensitive logs here.
- Notice questionsWhether any notice duty is even in view — with counsel.
Timeline
Sequence and clocks that change the next action.
- NowContainment and a single incident owner.
- First recordWhat, when, which systems, which categories.
Curated resources
Open the asset that matches this job.
Helpful to prepare
Facts that make the next conversation clearer.
These items are orientation aids, not a legal requirement list.
- Incident owner and containment status
- Whether personal information is involved
- Whether counsel should be on the next call
Evidence file
Preserve the record before the forum is chosen.
This is a preparation prompt, not a finding that any item is admissible or required.
- High-level incident chronology
- Systems and data categories involved
- Whether overseas recipients may be affected
- Notices already sent, if any
Local context
Add the city when regulator practice changes.
CAC and industry-regulator practice can differ after the national transfer or cybersecurity question is identified.
Open city and province guidesCounsel hand-off
Need data-privacy counsel?
This hub organises PIPL, cybersecurity and export questions. It does not decide whether a transfer is lawful or whether notice is required on your facts.
Find data-privacy counsel