Data Breach Notification Form - Employees

This notification form is for DXN employees to report to report any suspected or actual unauthorized access, misuse, loss, disclosure, or other concerns relating to their personal data held or processed by DXN. The information required in this form must be completed and submitted within 24 hours of discovery.

All reports will be reviewed and assessed by DXN to determine whether the matter constitutes a personal data breach or privacy incident. Appropriate actions will be taken in accordance with the Personal Data Protection Act 2010 (PDPA), Personal Data Protection Department (PDPD) Guidelines on Data Breach Notification 2025, applicable data protection laws (including GDPR where relevant), and DXN policies.

All information submitted will be treated as strictly confidential and used only for the investigation and management of the reported data incident.

SECTION 1: REPORTER DETAILS
Field Information
Name of Reporter:
Staff ID:
Department / Company:
Designation / Position:
Email Address:
Contact Number:
Date / Time of Discovery:
Date / Time Reported to DPO:
Method of Breach Discovery (e.g. system alert, audit, external report):
Supervisor / Head of Department Notified:
If Yes, Name & Date:
If not yet notified, state reason or intended time of notification:
SECTION 2: DESCRIPTION OF INCIDENT
INSTRUCTION:

Provide factual details of the incident as accurately as possible. Avoid assumptions or opinions. Attach supporting documents if available (e.g. screenshots, reports, system logs).

Definition - Data Subject:

A Data Subject is any person whose personal data is held or processed by DXN, such as employees, customers, members, or distributors.

Field Information
Description of Incident (Concise Factual Summary of Breach):
Chronology of Events Leading to the Breach (Provide a step-by-step sequence of actions or events leading to the incident):
Systems / Applications / Devices Involved:
Type of Breach (e.g. unauthorised access, accidental email disclosure, system misconfiguration, physical theft/loss):
Suspected Cause of Incident (e.g. human error, system misconfiguration, phishing, malware):
Initial Detection Source (Internal / External - e.g.
  • Internal: system alert, IT security team, employee report, audit finding.
  • External: customer complaint, vendor notification, regulator inquiry, media leak.):
Jurisdiction of Affected Individuals:
Other Parties Affected (if any):
Please list out these parties:
Type of Personal Data Involved (e.g. name, ID, contact, financial info):
Sensitive Personal Data Involved (e.g. health, biometric, religion):
If yes, describe:
Estimated Number of Affected Data Subjects:
Estimated Number of Data Records Affected:
Category of Individuals Affected (e.g. employees, members, customers):
Departments / Locations Affected:
Potential Consequences to Data Subjects (e.g. financial loss, identity fraud, credit damage, distress):
SECTION 3: INITIAL ACTION (CONTAINMENT MEASURES)
Field Information
Containment Steps Taken (e.g. disabled affected account, disconnected device, notified IT):
Was unauthorised access stopped? (To confirm if the incident is still active):
Evidence preserved (e.g. logs, screenshots, email, etc.)?
Details of Evidence Location / File Reference: (e.g. shared folder path, email subject line, log filename)
Was GIT / DPO informed immediately?
If yes, specify time/date:
SECTION 4: SIGN-OFF TABLE

By submitting this form, you acknowledge that the information provided will be processed by DXN Group solely for the purpose of investigating and managing the reported data breach.

All breach records and related documentation shall be retained for a minimum of 24 months (two years) from the closure date in compliance with the PDPD Guideline on Data Breach Notification (2025) and PDPA audit requirements.

Facebook Instagram Blogger