Confidentiality incidents (Law 25)

Your union's Law 25 incident register: every confidentiality incident - unauthorized access, use, communication or loss of personal information - recorded, assessed, notified when required, and kept for five years. This is your organization's own legal obligation (art. 3.8 of the Act respecting the protection of personal information in the private sector). Admin only.

Where to find it

Open Workbooks, section Internal regulations, entry Confidentiality incidents (Law 25). The entry is visible to owners and administrators only - members never see it. The dashboard shows open/closed counts, overdue assessments, serious-risk cases and pending notices, then the register itself with status and serious-risk filters.

Declare an incident

1. Click Declare incident.
2. Describe the personal information concerned as categories (« member email addresses in a distribution list ») - never copy the leaked data itself. If the exact scope is unknown, say why.
3. Record the circumstances, the date it happened (or the period, flagged approximate) and the date you became aware.
4. Estimate the number of people affected (flag approximate when unsure).
5. Write down the risk assessment factors: how sensitive the information is, what could foreseeably follow, how likely harmful use is.
6. Record the mitigation measures taken to reduce harm and prevent recurrence.

Triage workflow

Status	Meaning
Detected	Just declared, waiting for assessment.
Assessing	The serious-risk evaluation is under way.
Contained	Harm reduced, recurrence prevented - still needs its notices decided.
Notified	The CAI and affected persons were notified where required.
Closed	Finished. Terminal - closed incidents can no longer be edited.

Move an incident forward from the detail screen. Contained and notified incidents can return to assessing if new facts emerge. If the risk of serious injury exists, notify the Commission d'accès à l'information and the affected persons promptly - record both dates on the Notices & filings tab, with the public-notice decision and its reason.

Export for the CAI

Export register (CAI copy) downloads the full register as CSV - the eight legally required fields per incident. Hand that file over when the Commission requests a copy. Every export is logged.

Retention and history

The register is kept at least five years after the date you became aware of each incident. There is no delete button: corrections are new audited updates, and the Log tab shows every creation, status change, edit and export. Nothing important silently disappears.

What happens behind the scenes

Each union sees only its own register (strict tenant isolation - another union's incidents are unreachable, even by ID). Writes carry the confidentiality_incidents.view/create/update permission checks and land in the audit log with your organization attached. Reads are limited to administrators by both the navigation and the server.

See also

• Administration - roles and audit logs.
• Delegates - who can hold the administrator role.