Illustrative idea · PRIVACY OPERATIONS
Track privacy requests
Keep requests, owners, deadlines, and decisions visible to the people responsible for responding.
Keep incident details, decisions, and follow-up together.
Illustrative idea, not a published runnable template. Grunt is prelaunch; live service is paused and live provider connections and outcomes remain unverified. The steps, providers, and outcomes below describe a concept.
Give staff a consistent way to record a confidentiality incident, add follow-up details, and keep open matters visible to the person responsible for privacy.
Actual availability depends on published steps, supported connections, permissions, and provider approval.
Incident recordA confidentiality incident reported by an authorized staff member
“Record the incident and its initial assessment, then update notice dates, mitigation, and status as people investigate and respond.”
Work through the request.
Clear tasks, with review where it matters.
- Record an incident
- Assign a reference and retain the record
- Assess risk through the proper people
A dated incident register with unique references, tracked follow-up, daily reminders for entries needing attention, and an exportable record.
What this workflow could do
Collects incident information, records an initial status, supports later notice and mitigation updates, and summarizes matters that need the privacy lead’s attention.
Review points proposed in this idea
This is a record-keeping aid, not legal advice or a legal risk assessment. A qualified person must assess the incident, decide whether notices are needed, and determine the appropriate timing; the process does not establish compliance by itself.
How the idea could work
Select an illustrative task to explore its proposed role. No workflow runs here.
-
Capture the incident details, discovery date, affected information categories, and the staff member making the report.
-
Give the entry a unique reference and calculate its five-year retention date for the responsible team.
-
Record the risk conclusion made by the responsible person; do not treat a form response or automated status as a legal determination.
-
Add notice dates, public notice or delay reasons, and additional mitigation as the incident is handled.
-
Require the responsible person to complete the information needed for serious-risk or unassessed cases before closure.
-
Surface notices due, long-unassessed entries, and records past their retention date, and provide a register export when requested.
Step 1 of 6
Record an incident
Capture the incident details, discovery date, affected information categories, and the staff member making the report.
Proposed setup considerations
These are planning notes for the concept, not instructions for a currently available template.
- 01
Choose authorized staff and access
Decide who may report incidents, update records, review notices, and maintain the register.
- 02
Set incident fields and categories
Agree what information staff must provide and which personal-information categories should be available for selection.
- 03
Name the privacy lead and reminders
Choose the reminder recipient, sender, schedule, and threshold for bringing unassessed entries to attention.
- 04
Review the record-keeping process
Confirm how staff assess risk, document decisions, handle notice timing, retain records, and seek legal guidance when needed.
Read the prelaunch status
Published templates and verified customer availability remain pending.
A little help with the whole task
A little less busywork.
A little less busywork.
A little more room for you.
Explore the sample experience while launch details are being finalized.
View pricing status Explore the simulation