Personal Data Incident Reporting Procedure

1. When to Report
Upon discovering or receiving a report of suspected theft, disclosure, alteration, damage, loss or other infringement involving personal data held by the University, immediately notify your unit supervisor and the University’s Personal Data Protection Contact Point, and take necessary measures to prevent further harm. If information systems or information security are involved, also notify the relevant responsible units.

2. Reporting Deadlines
Internal Reporting: Report immediately and, in accordance with the University’s internal reporting deadline, submit preliminary incident information and a written record to the University’s Personal Data Protection Contact Point within 36 hours of becoming aware of or discovering a suspected incident.
Reporting to the Ministry of Education: When a personal data breach occurs, the Personal Data Protection Promotion Team and the Personal Data Protection Contact Point shall coordinate reporting to the Ministry of Education within 72 hours of discovery, using the “Personal Data Breach Incident Report and Record Form.” The handling measures and results shall also be submitted to the Ministry for record within one month after incident handling is completed.
If information is incomplete, submit an initial report and provide additional information later. Do not delay reporting while awaiting verification.

3. Incident Handling Principles
The unit involved shall provide an account of the incident, the data involved, the scope of impact and the measures taken. It shall cooperate in investigating the cause, preserving evidence, notifying affected data subjects and implementing improvements, and retain relevant records in accordance with University procedures.

4. Reporting Contact and Related Documents
Reporting Contact: Personal Data Protection Contact Point, Office of Library and Information Services

Document Download:
Personal Data Breach Incident Report and Record Form (PDF) (available in the attachments on this page)