Vendor Summary Report of Personal Data Incident

Select report type:
Initial reports only
If there has been a delay in reporting this incident, please explain.	Click here to enter text.
Description of the Incident
What has happened?	Click here to enter high level summary of cause, type, and nature of incident. ☐ Deceit and social engineering ☐ Errors and omissions ☐ Fraud ☐ Hacking or unauthorized access ☐ Malicious code ☐ Misuse and abuse ☐ Physical security ☐ Other Click here to enter text.
Which third-party was involved, if any?	Click here to enter text.
How did you find out about the incident?	Click here to enter text.
Timing of the Incident
When were you notified about the incident?	Date: Click to select date. Time: Enter time.
When did the incident happen?	Date: Click to select date. Time: Enter time.
Is the incident still on-going?	Click to enter any comments here.
Nature of the Incident
Was the incident caused by a cyber incident?
Has the confidentiality, integrity, and/or availability of your systems been affected?
Please tick all that apply: ☐ Confidentiality ☐ Integrity ☐ Availability
Geographical location of the Incident
In which geographical location(s) has the incident occurred?	Click here to enter text.
Where do the affected individuals reside (E.g. EU, etc.)?	Click here to enter text.
Personal Data
Categories of personal data included in the incident (select all that apply) ☐ Data revealing racial or ethnic origin ☐ Political opinions ☐ Meal preferences (that may reveal religious or philosophical beliefs) ☐ Trade union membership ☐ Sex life data ☐ Sexual orientation data ☐ Gender reassignment data ☐ Health data ☐ Basic personal identifiers, E.g. name, contact details ☐ Identification data, E.g. username, password ☐ Social Security Number ☐ Economic and financial data, E.g. credit card numbers ☐ Official documents, E.g. driving licenses ☐ Location data ☐ IP addresses (network data) ☐ Criminal convictions, offences ☐ Genetic or biometric data ☐ Basic personal identifiers, E.g. name, contact details ☐ Not yet known
Volume of personal records included in the incident:
Individuals
Categories of individuals:	Click here to enter text.
Number of individuals affected:
Impact Severity and Likelihood
Describe the nature of the risks that individuals may experience:	Click here to enter text.
Please select from the following list the potential risks:	☐ Loss of control over their personal data ☐ Limitation of their rights ☐ Discrimination ☐ Identity Theft ☐ Fraud ☐ Unauthorized lifting of pseudonymization ☐ Financial losses ☐ Reputational Damage ☐ Other Click to enter text.
Where there was a potential loss of confidentiality, please select from the list:	☐ The data was disclosed to unauthorized recipients ☐ The data can be correlated with other personal information of the individual involved ☐ The data may be used for purposes other than those provided for and/or unfairly ☐ Other
What is the likelihood that individuals will experience serious risks as result of the incident?	Click here to enter text. If not yet known, please give details.
Availability of Services
System Recovery Time
Provision of Critical Services
Containment and Mitigation Measures
Containment
Describe any measures in place before the incident with the aim of preventing an incident of this nature:	Measures in place before the incident with the aim of preventing an incident of this nature.
Mitigation
Describe the actions taken, or are planning to take, as a result of the incident:	Include, where appropriate, actions you have taken to fix the problem, and to mitigate any adverse effects, E.g. data sent in error has been destroyed, updated passwords, planning information security training.
Eradication
Describe measures put in place to eradicate the incident and avoid it being repeated:	Click here to enter text.
External Notifications
Have you told any third-party organizations or individuals about the incident?	E.g. The police, other regulators or supervisory authorities.
Have you told any individuals about the incident?	Add any information as to which individuals were notified.

Please attach the form to an email and send to CWTinformationsecurity@mycwt.com.