An incident or non-conformity is a recorded event or observation that does not comply with applicable requirements, procedures or expected practices. Recording incidents in Diri documents what happened, makes follow-up traceable and feeds continuous improvement.
You find both features under Governance & Compliance in the left-hand menu:
The person you set as reporter, and the participants you add, are notified.
An incident is handled in five steps, similar to a risk assessment:
Across the first two steps you record:
Use Uploaded documents on the incident to attach documentation or supporting evidence as an audit trail.
Affected customers are chosen from the customer register. A name that is not already there is added to the register as a customer. Only people with access to the customer register can see which customers are named; others see how many are recorded. See Parties and customers.
In step 2, answer Does the incident contain personal data?. If you answer Yes, fill in which data processing activities, personal data and users are affected, how many users, and the Data processing responsible.
You are then asked Must the incident be reported to the data protection authority?. Under GDPR article 33, a personal data breach must be reported within 72 hours of its discovery, unless it is unlikely to result in a risk to people's rights and freedoms. The decision must be documented either way.
The incident then shows whether the report task is open, overdue, done or closed without being done. You can send a new task if needed. If the 72 hours have already passed, report without further delay and give the reasons for the delay in the report. You can close the incident while the report task is still open; the task stays on the task board until it is done.
The Incident Registry lists the registered incidents that are relevant to you, with severity, assessed consequences and implemented treatments.
To register many incidents at once, select Import on the Incidents page and upload an Excel or CSV file. See Bulk import.
An incident can be linked as evidence to a framework control, for example to show that your incident process is in use. See Controls and evidence.