# Confidentiality incidents (Law 25)

# Confidentiality incidents (Law 25)

Your union's Law 25 incident register: every confidentiality incident - unauthorized access, use, communication or loss of personal information - recorded, assessed, notified when required, and kept for five years. This is your organization's own legal obligation (art. 3.8 of the Act respecting the protection of personal information in the private sector). **Admin only.**

**In short:** Workbooks → Internal regulations → Confidentiality incidents → _Declare incident_. Describe categories of information, never paste leaked personal data.

## Where to find it

Open **Workbooks**, section **Internal regulations**, entry **Confidentiality incidents (Law 25)**. The entry is visible to owners and administrators only - members never see it. The dashboard shows open/closed counts, overdue assessments, serious-risk cases and pending notices, then the register itself with status and serious-risk filters.

## Declare an incident

1.  Click **Declare incident**.
2.  Describe the **personal information concerned** as categories (« member email addresses in a distribution list ») - never copy the leaked data itself. If the exact scope is unknown, say why.
3.  Record the **circumstances**, the **date it happened** (or the period, flagged approximate) and the **date you became aware**.
4.  Estimate the **number of people affected** (flag approximate when unsure).
5.  Write down the **risk assessment factors**: how sensitive the information is, what could foreseeably follow, how likely harmful use is.
6.  Record the **mitigation measures** taken to reduce harm and prevent recurrence.

**Descriptions only:** the register must never contain the leaked personal information itself - only what kind of information was involved.

## Triage workflow

| Status | Meaning |
| --- | --- |
| Detected | Just declared, waiting for assessment. |
| Assessing | The serious-risk evaluation is under way. |
| Contained | Harm reduced, recurrence prevented - still needs its notices decided. |
| Notified | The CAI and affected persons were notified where required. |
| Closed | Finished. Terminal - closed incidents can no longer be edited. |

Move an incident forward from the detail screen. Contained and notified incidents can return to assessing if new facts emerge. If the risk of serious injury exists, notify the **Commission d'accès à l'information** and the **affected persons** promptly - record both dates on the **Notices & filings** tab, with the public-notice decision and its reason.

## Export for the CAI

**Export register (CAI copy)** downloads the full register as CSV - the eight legally required fields per incident. Hand that file over when the Commission requests a copy. Every export is logged.

## Retention and history

The register is kept **at least five years** after the date you became aware of each incident. There is no delete button: corrections are new audited updates, and the **Log** tab shows every creation, status change, edit and export. Nothing important silently disappears.

## What happens behind the scenes

Each union sees only its own register (strict tenant isolation - another union's incidents are unreachable, even by ID). Writes carry the `confidentiality_incidents.view/create/update` permission checks and land in the audit log with your organization attached. Reads are limited to administrators by both the navigation and the server.

## See also

-   [Administration](/docs/guides-admin) - roles and audit logs.
-   [Delegates](/docs/guides-delegates) - who can hold the administrator role.