DATA INCIDENT REPORT

Important Notes:

Please use this Form to report data breaches to the Personal Data Protection team ("PDP Team") in the Office of Risk Management and Compliance if there are data breaches involving personal data ("PD") including Business Contact Information (BCI) (i.e., Details of individuals required for business purposes.)
Refer to the NUS Data Management Policy (DMP) for more details.
To be completed by Data Users and submitted to DPO at dpo@nus.edu.sg
Please do not reference any data subjects by name in this report.
Circulation of this report must be restricted to those involved in investigating/evaluating the incident.
Timelines:
- Containment of the data breach: As soon as possible and in any event no later than one (1) calendar day after the Data Steward/HOD first becomes aware of the data breach.
- Completion of this Data Breach Report and submission to DPO at dpo@nus.edu.sg Within one (1) calendar day after the Data Steward/HOD first becomes aware of the data breach.
- All additional information/updates related to the data breach must be reported to DPO using this Form within one (1) working day after the Data Steward/HOD first become aware of the said additional information.

Category	Details	Response
Nature and Details of the Data Breach	Describe what happened and the extent of the breach.
Personal Data (PD) Leaked	List the types of PD and BCI that were exposed.
Purpose/Intent of the PD	Explain why this data was collected and its intended use.
Discovery of the Data Breach	Identify who first discovered the breach and how they found it.
Details of the Breach	Provide information on why and how the breach occurred.
Personnel Involved	Mention any individuals or teams involved in the incident.
Other Relevant Information	Include any additional details that are important to note.

Risk Factor	Question	Response
Reportable to PDPC	Are 500 or more records impacted?	Yes No
Is there potential harm to data subjects (e.g., credit card details leaked)?	Yes No
Complaints	Is there a possibility of data subjects lodging a complaint to PDPC?	Yes No
Operational Disruption	Will the breach disrupt operations for one work day or more?	Yes No
Reputation Damage	Could this breach damage the university's reputation if made public?	Yes No
Public Accessibility Duration	Was the compromised data publicly accessible for more than 24 hours?	Yes No
Third party involvement	Were there any other organisations affected?	Yes No
Affected individuals	Are there any Singapore-based Individuals affected?	Yes No

Action	Description	Response
Isolated Affected Systems	Disconnected compromised systems from the network to prevent further damage.	Yes No
Changed Access Credentials	Reset passwords and access keys for affected accounts.	Yes No
Notified Affected Individuals	Informed individuals whose data was compromised and the steps being taken.	Yes No
Removed Public Data	Removed leaked data from public websites.	Yes No
Engaged Forensic Experts	Hired experts to investigate the breach and preserve evidence.	Yes No
Secured Physical Areas	Locked and secured physical areas related to the breach.	Yes No
Updated Software and Systems	Applied patches and updates to software and systems to fix vulnerabilities.	Yes No
Conducted Staff Training	Provided training to staff on data protection and breach response.	Yes No
Reviewed and Updated Internal Process	Reviewed and updated internal data protection process.	Yes No
Monitored for Further Breaches	Continuously monitored systems for signs of further breaches.	Yes No
Verified Data Integrity	Ensured the integrity and accuracy of data by cross-checking with the data subject affected.	Yes No
Provided Support to Affected Individuals	Offered assistance to individuals impacted by the breach (e.g., credit monitoring).	Yes No

Section D: Declaration by Reporting Personnel

Status of investigation by Department: *	Initiation: The investigation has just started. Ongoing: The investigation is actively being conducted. Pending: Awaiting further information or actions. Completed: The investigation has concluded, and findings are available.
Date of completion of investigation by Department:

Declarations: *

I confirm the information stated herein is complete, true and accurate at the time of submission of this Report.

My Head of Department /Data Steward have been informed of the data incident and have reviewed this incident report.

If there are any changes in circumstances or updates in relation to the data breach incident, I will inform DPO immediately with an update of this report as soon as I am aware of the same.

The Department affirms that all supporting evidence of the corrective and preventive actions taken will be submitted to dpo@nus.edu.sg for verification and record-keeping.

1a.	1a. Does this data breach involve PD? * YES NO If no; there is no need to report to the NUS PDP Team. You would however need to report to NUS IT for data breaches that do not involve PD using the on-line IT security Form at https://forms.office.com/pages/responsepage.aspx?id=Xu-lWwkxd06Fvc_rDTR-gtCIKGO2DKhNkGJ8fF10JrtUNjRORkNSRlMwTzQzQzNDMTNYUDJaTFZIWCQlQCN0PWcu&route=shorturl
1b.	1b. Does the personal data relate to human subjects research? * Yes No If “Yes”: Please ensure that NUS IRB (irb@nus.edu.sg) reporting requirements are followed.
2.	2. Date of occurrence of data breach incident: * Date: Time:
3.	3. When did the Reporting Personal first become aware of the data breach: * Date: Time:
4.	4. When did the Data Steward/HOD/RO first become aware of the data breach: * Date: Time:

Data Category	Specific Data items	How many records were impacted?	Action

Important Notes:

Section A: Case Information

Section B: Data Breach Report involving Personal Data

Section C: Remediation & Corrective Actions

Section D: Declaration by Reporting Personnel

Contact Information

Declarations: *

Name *
Email *

DATA INCIDENT REPORT

Important Notes:

Section A: Case Information

Section B: Data Breach Report involving Personal Data

Section C: Remediation & Corrective Actions

Section D: Declaration by Reporting Personnel

Contact Information

Declarations: *

Thank You!