Information Management and Technology IM13 - Privacy Incidents

Accessed:	2026-07-17
Purpose of series:	Records documenting the investigation of privacy breaches, complaints and other incidents to determine if unauthorized access, collection, use or disclosure of personal information has occurred.
Scope and contents:	Includes (but is not limited to): Notificaition of incident, investigation records, reviews, reports, management of incident, meeting notes, supporting documentation and related correspondence.
Cross reference:	For reports and statistics see: Administration - Reports and Statistics (AD70)
Exceptions:

Primary offices:	Privacy Office
Primary office retention trigger:	Superseded / Obsolete
Primary office disposition:	Secure Destruction
Primary office retention period:	8 years
Primary office retention instructions:	S/O= Date incident or investigation resolved or completed. Once incident or investigation resolved or completed retain for 8 additional years, then securely destroy.

Secondary offices:	Units
Secondary office retention trigger:	Calendar Year
Secondary office disposition:	Secure Destruction
Secondary office retention period:	2 years
Secondary office retention instructions:	CY= December 31 of calendar year unit completed submission to Privacy Office's or Legal Counsel request. Once information submitted retain for 2 additional calendar years, then securely destroy.

Retention rationale:

Expected operational use.

Vital records	Electronic systems	Personal information	Official media
Yes	NAS, SharePoint, Legal Files	Yes	Paper, Electronic

Approval date:	Last updated:	Edited by:	Security classification:
2023-01-27	2026-06-29 16:54:49	laheyd	Confidential

Notes: