Register of incidents: what the decision maker looks at
A decision maker examining a register of incidents checks four things: whether every incident is logged, whether the timeline from detection to closure is complete, whether the severity rating matches the facts, and whether corrective action is dated and evidenced. A register with a gap in any of these four areas is read as proof of a weak process, not as a one-off oversight, and the review slows down accordingly.
What a gap in the register changes
A complete register lets a reviewer close the file in one sitting. A register with missing entries, blank dates, or an undated remediation step forces a second round of questions, and the file stays open longer than either side expected. The delay is administrative, not punitive, but it still costs time that a busy team would rather not spend twice.
The same pattern appears elsewhere. How field-of-use drafting IP licence what the decision maker looks at is a close parallel: a missing usage boundary is read as a gap in control, not as a wording choice. A missing date in an incident register is read the same way.
Timing follows from completeness, not from the size of the incident. A minor incident with a clean, dated record moves faster through review than a serious incident with a patchy one, because the reviewer is judging the file, not just the event it describes.
Why the format matters as much as the content
A register that looks complete can still fail on format. Entries edited after the fact, without a note of when the edit happened, read as an attempt to tidy the record rather than as evidence of good housekeeping. A spreadsheet with no version history invites the same reading, even when nothing was actually changed to hide anything.
A register built from several disconnected files — one for detection, another for remediation, a third for sign-off — is harder to check than a single file kept in one place. The reviewer has to reconcile three sources instead of reading one, and reconciliation is where most delay accumulates.
What to prepare before the review starts
- Assign one person to own the register before the review is scheduled, not after it is announced.
- Pull every entry from the relevant period into a single file, in date order.
- Check that each entry carries a detection date, a closure date, and a named owner.
- Attach the evidence of the corrective step to the entry it relates to, not to a separate folder.
- Flag any entry with a missing field before the reviewer finds it, with a short note on why.
- Prepare a one-page summary of the period, cross-referenced to the register by entry number.
The same discipline applies whenever a written record has to survive outside scrutiny. How change control procedure technology contract what the decision reviews a change log is built on the identical habit: date every step, name every owner, and keep the evidence next to the entry it supports.
Who decides, and on what timetable
| Stage | Who acts | Typical timing |
|---|---|---|
| Register pulled and checked internally | Incident owner or compliance lead | Before the review is scheduled |
| Register submitted or presented | Compliance lead or nominated representative | On the date set by the reviewing body |
| Initial read and first questions | Reviewing body | Within days of receipt, if the file is short |
| Questions on gaps or inconsistencies | Reviewing body, in writing or in a meeting | Within the period set at submission |
| Response to questions | Compliance lead, with supporting evidence | Within the deadline given in the request |
| Decision on adequacy of the register | Reviewing body | After the response period closes |
The decision maker is rarely a single person. It is usually a body acting on a file, and the file is what carries the outcome forward, not a verbal impression left after a meeting. The same is true wherever documents, rather than people, end up under decisive scrutiny. Reserve evidence and attestation token issuance documents to prepare is answered before the review starts, for the same reason a register is checked before a reviewer ever asks to see it.
Three common forks
If the register is complete and every entry is dated, the review closes on the papers alone, with no follow-up meeting needed. This is the fastest path and the one worth building the register around.
If the register has gaps but the underlying incidents were minor, the reviewer usually asks for a written explanation rather than opening a full inquiry. A prompt, specific answer to that request tends to close the file within the original timetable.
If the register has gaps and one of the incidents was serious, the reviewer typically escalates to a broader inquiry, and the timetable set out above stops being indicative. When a rival launches an obvious workaround: when the other side moves first shows the same escalation logic: a gap that looked minor changes character once a second party has acted on it.
What this page does not cover
This page does not set out how severity should be classified, nor what counts as a reportable incident in the first place. It does not name a deadline for notifying a supervisory authority or an affected individual, because that deadline depends on facts that are not fixed here.
It also does not cover what happens once the reviewing body decides the register is inadequate. That outcome opens a separate track, with its own procedure and its own timetable, and it is not addressed on this page.
Related reading
The review described here shares a structure with a broader procedure. Supervisory inspection: what the decision maker looks at covers the wider inspection, of which the register is usually one part rather than the whole subject.
Verified
Reviewed as of the current publication date. This page reflects standard administrative and internal audit practice for incident registers within the EU. It does not cite a specific act, because the procedure it describes — how a reviewer works through a document — does not depend on which instrument triggered the review.
Frequently asked questions
How long does register of incidents take in practice?
A clean register with complete dates closes in a single review cycle, often within a few weeks. A register with gaps adds a written-question round, which typically adds several more weeks before a decision is reached, sometimes longer if the underlying incident was serious.
Which documents are needed to start?
The register itself, in date order, with a named owner per entry, and the evidence of remediation attached to each entry it relates to. A one-page summary cross-referenced to entry numbers speeds up the first pass and reduces the number of clarifying questions.
What happens if the other side does not respond?
A reviewing body that receives no response by the stated deadline typically proceeds on the file as submitted, drawing its own conclusions from the gaps rather than waiting indefinitely for an answer that has not arrived.
Where this fits next
If children's data sits anywhere in the product, the register needs a different first step before anything else is checked. When children's data appears in the product: what to do first sets that out.
If an AI feature changed how data moves through the product before the incident occurred, the register may need to be read alongside that change. What it costs to be wrong in this situation covers that separately.
If the records of processing behind the register are themselves incomplete, that gap tends to surface at the same review, and often before the register does. When records of processing are incomplete: what it costs to be wrong sets out that consequence.