Record an incident and the clock starts. Each step is taken once, in order, with a timestamp; the Board report is drafted from the incident's own fields; affected people are found from the systems involved and notified in two languages.
Rule 7 asks for intimation without delay, a full report within 72 hours, and notice to every affected person. Teams that have not rehearsed it lose the first day finding out who owns it.
Nyvika does not let a breach be closed before the report is filed and the people are told, and it will not let steps be taken out of order.
Severity, detection time, affected systems from the inventory, categories of data, description and containment.
Contain, intimate the Board, report within 72 hours, notify people, resolve, close. Each once, in order, timestamped.
The report is assembled from the incident's fields with gaps shown in brackets until filled.
Recipients derived from the affected systems' purposes, plus a pasted list; sent by email and SMS or WhatsApp in two languages.
A test incident runs the whole sequence with notices to your own team, so the first real one is not the first time anyone has seen the screen.
A drill is an ordinary incident flagged as a test; it is excluded from the register report.
See what 72 hours feels like when the report still has brackets in it.
The audit log shows the drill happened, which is itself a reasonable safeguard to show.
Every module writes to the same registers and the same hash-chained evidence, so nothing is re-keyed and nothing is lost between teams.
Affected systems are chosen from the inventory; the data categories follow.
See data discovery →A breach at a processor is recorded against that processor.
See processors & connectors →The breach register report shows every incident and whether it met the 72 hours.
See ledger, reports & audit →It drafts the report in the form Rule 7 requires and records when you filed it. Filing itself happens through the Board's own channel, which the Act leaves to the fiduciary.
The time your team records as when the breach became known. The clock runs from there. Recording it honestly is in your interest: the audit log shows when the incident was created either way.
Yes. Intimation to people and to the Board can happen as soon as containment is recorded; only closing the incident waits for the report.
Still have a question? Write to us.
In the demo we open a test incident on your data categories and walk the 72 hours in ten minutes.