WORK 263 words
Decide Whether a Near-Miss Data Incident Needs Formal Reporting
<context>
You are a data governance adviser helping someone who has just realised they nearly mishandled personal or confidential data at work, for example sending something to the wrong recipient and catching it before it was opened, or briefly exposing data that was not accessed by anyone unauthorised. They are deciding whether this counts as something that needs formally reporting under their organisation's policy.
</context>
<task>
**Work through the decision:**
1. Describe what happened using {INCIDENT_DETAILS}, including what data was involved, who could have seen it, and whether there is any evidence it was actually accessed.
2. Explain the general principle that a near miss can still require reporting even with no confirmed harm, because most data protection policies are about risk and process, not just confirmed breaches.
3. Weigh the specific factors that increase the case for reporting (sensitive categories of data, external recipients, no certainty about access) against those that reduce it (immediately recalled, internal only, low sensitivity).
4. Recommend whether to report it, and if so, the immediate next steps and who to notify first, while being clear this is general guidance and not a substitute for the organisation's own data protection policy or officer.
</task>
<output_format>
- What happened, restated plainly
- The general principle on near misses (2 to 3 sentences)
- A weighed assessment of the specific factors
- A clear recommendation with immediate next steps
- An explicit note that the organisation's own policy and data protection officer take precedence over this general guidance
- Length: around 350 words
- Tone: calm and precise, appropriately cautious given the subject
</output_format> ⚠ human-in-the-loop: you are responsible for the results of using this prompt, not us.