Record and report a data breach

Record a personal data breach, assess whether it is likely to cause significant harm, and keep track of the Commissioner and data subject notification deadlines.

Steps

1. 1Open Privacy (PDPA) → Breaches and select Record a breach. Enter a short title, what happened, when it was discovered and — if you know — when it occurred, the personal data involved and roughly how many people are affected.
2. 2The page shows the Commissioner deadline straight away, counted as your settings say (by default 72 hours from when the breach occurred, or from discovery if that is unknown). Reminders go to the owner and everyone who can edit privacy records before it is due.
3. 3Under Risk assessment, tick what the breach could cause — physical harm, financial loss, credit records, property loss, illegal misuse, sensitive data, identity fraud. A large number of people also counts. Choose the risk level and decide whether significant harm is likely.
4. 4Under Notifications, open the draft for the Commissioner in Bahasa Melayu, English or 中文. It is filled from your notice template with the incident details and your DPO’s contact. Send it through the Commissioner’s form or email, then record the time and any reference.
5. 5If you notify after the deadline, MetriCRM asks for the reason for the delay so it is on record.
6. 6When significant harm is likely, notify the affected people too — the data subject deadline counts from your Commissioner notification — and record when you did.
7. 7Add evidence as you go: notes and files (stored encrypted, with a SHA-256 fingerprint). Mark the incident contained, and close it once it is assessed and, if needed, notified. Breach records are kept for audit and are never removed by retention.

Still need help? Contact support