Requirement
The entity creates and retains a complete, accurate, and timely record of detected or reported unauthorized disclosures (including breaches) of personal information to meet the entity’s objectives related to privacy.
Points of Focus
Creates and Retains Record of Detected or Reported Unauthorized Disclosures [P] [C]
Requirement: The entity creates and maintains a record of detected or reported unauthorized disclosures of personal information that is complete, accurate, and timely.
Explanation
The organization must also keep a reliable log of disclosures that were never supposed to happen — leaks, breaches, and other unauthorized releases of personal information, whether detected internally or reported by others. Auditors care because this record drives breach notifications and shows whether the organization actually tracks its privacy incidents.
