Triggering Guidance Using DINA

You can trigger guidance for a jurisdiction based on your answers to the Dynamic Incident Notification Assessment (DINA). If you are not seeing the expected guidance results after completing the assessment, use the DINA Trigger Rules spreadsheet. The spreadsheet shows the question responses required to display guidance for each jurisdiction.

The spreadsheet is updated regularly to account for ongoing changes to DINA trigger rules.

Note:

Use this link to access and download the Dynamic Incident Notification Assessment (DINA) Trigger Rules spreadsheet.

Best Practices and Expert Advice

Assessment Question Friendly Names

The DINA displays friendly names for each question in the assessment. These friendly names appear on the Dynamic Incident Notification Assessment pane on the left-hand side of the screen and are referenced in the DINA Trigger Rules spreadsheet.



Required DINA Responses

The DINA Trigger Rules spreadsheet only includes the required responses needed to generate the guidance for a specific jurisdiction. Some questions listed in the DINA are not required to generate a specific guidance because the response doesn't affect the rule triggering.

For example, if you are attempting to trigger the notify individual guidance for the state of Arizona, based on the spreadsheet, you do not need to answer the Number of Individuals question to trigger the guidance. However, the Number of Individuals question is required to trigger the notify authority guidance for the state of Arizona.

Frequently Asked Questions

The General Incident Details section only has four questions, how can I assess multiple jurisdictions with only four general questions?

The analysis for many jurisdictions is fairly straightforward and uniform - particularly in the European Union (EU). Anything that aligns to the EU is mapped to the General Incident Details section which consists of seven questions - three with show logic. Any outliers get their own section to account for additional questions that need to be asked for a specific jurisdiction.

The likelihood and the severity may differ in jurisdictions, how is this accounted for when multiple jurisdictions are grouped together in the General Incident Details section.

Likelihood and severity relates to the risk to an individual as a result of a breach of their information. Typically, this information is analyzed globally and not by jurisdiction. The DINA should be used at a stage that follows the initial incident notification by a business owner and when the basic facts of the incident scope can be assessed.

Due to the underlying legal rules impacting the recommendations produced by DINA, we advise respondents to only use it when they have an indication that the cross-border incident is not low-risk for the impacted individual.