Privacy Incident Severity & Triage UI in Figma

Quick answer

Privacy incident triage UI turns noisy alerts—vendor emails, internal tickets, user reports—into a scored, prioritized queue with clear escalation paths. Design a unified intake inbox, severity rubric wizard (data sensitivity × exposure × harm likelihood), auto-routing rules, and SLA timers that feed breach notification, subprocessor breach, and war room workflows. Start from the Figma guides hub and pair with privacy request queue, audit log, posture dashboard, and Dev Mode handoff.

Who this is for

Product designers building privacy ops tooling that sits upstream of breach and DSAR workflows.
Privacy and legal teams drowning in unclassified alerts at different severity levels.
Security and IR leads who need a single triage queue before opening a full war room.

Unified privacy incident inbox

PrivacyIncidentInbox — Acme App · 14 open incidents · 2 critical SLA breaches
├── Header: Awaiting triage 5 · In assessment 4 · Escalated 2 · Monitoring 3 · Closed 30d: 28
├── Actions: [ Log incident ] [ Import vendor alert ] [ Bulk re-score ] [ Export queue ]
├── Tabs: All · Vendor · Internal · User report · Regulator inquiry · False positive archive
├── Sort: Severity score · SLA remaining · Source · Region impact · Created
├── Row example:
│   PIN-1044 · Vendor alert · EmailCo · Score 78 Critical · SLA 2h · Assignee: @legal · Triage
│   PIN-1043 · User DSAR spike · Score 42 Medium · SLA 24h · Linked PRQ-882 · Review
│   PIN-1042 · Misconfigured bucket · Internal · Score 91 Critical · War room open · Active
└── Link: [Subprocessor breach](/designing-subprocessor-breach-notification-and-cascade-impact-ui-in-figma/) · [Privacy queue](/designing-privacy-request-queue-and-case-management-ui-in-figma/) · [Audit log](/designing-audit-log-and-security-activity-ui-in-figma/)

Column / element	Purpose
Severity score	0–100 composite from rubric
Tier label	Critical / High / Medium / Low / Informational
SLA timer	Time to first triage decision or escalation
Source	Vendor, internal, user, regulator, automated
Linked workflows	War room, breach filing, DSAR queue

Verdict: Triage fails when every alert looks urgent—a visible score and SLA timer force consistent prioritization.

Severity scoring rubric wizard

SeverityRubric — PIN-1044 · Step 3 of 5 · Current score: 78 (Critical)
├── Dimension 1 — Data sensitivity (weight 30%):
│   ├── Categories involved: Email, name, IP · Special category: No · Children: Unknown
│   ├── Score: 55/100 · Rationale: PII but not health/financial
│   └── Link: [ROPA](/designing-records-of-processing-activities-and-data-mapping-ui-in-figma/) activity ACT-441
├── Dimension 2 — Exposure scope (weight 30%):
│   ├── Records affected: 98,000 (vendor estimate · unverified)
│   ├── Regions: EU 41k · UK 12k · US 45k
│   └── Score: 85/100 · Rationale: Large cross-border exposure
├── Dimension 3 — Harm likelihood (weight 25%):
│   ├── Threat: Unauthorized API access · Data at rest encrypted: Vendor claims yes
│   ├── Likely harm: Phishing, identity correlation
│   └── Score: 70/100
├── Dimension 4 — Containment status (weight 15%):
│   ├── Vendor rotated keys · Your systems: Not involved
│   └── Score: 40/100 · Partial containment
├── Composite: 78 → Tier Critical (threshold ≥ 75)
├── Override: Legal may bump tier with documented reason · Audit logged
└── Actions: [ Apply score ] [ Request more data ] [ Mark insufficient info ] [ Escalate DPO ]

Use weighted dimensions your legal team agrees on—not a single subjective dropdown.

Severity tier definitions

Tier	Score range	Typical triggers	Default actions
Critical	75–100	Confirmed breach · Large PII exposure · Regulator clock	Open war room · Start breach UI
High	55–74	Likely breach · Medium exposure · Enterprise contract	DPO review within 4h · Pre-draft notifications
Medium	35–54	Possible incident · Limited scope · Contained	Assign owner · 24h assessment SLA
Low	15–34	Policy deviation · No PII confirmed	Track · Resolve in 72h
Informational	0–14	Near-miss · Training exercise	Log only · No escalation

TierBadge — Visual system
├── Critical: Red · Pulsing SLA under 2h · Auto-page on-call
├── High: Orange · Solid border · DPO notification
├── Medium: Amber · Standard row
├── Low: Gray · Collapsed by default in inbox filters
└── Accessibility: Never rely on color alone · Icon + text label per tier

Auto-routing and escalation rules

EscalationRules — Admin config · Last updated 2026-08-01
├── Rule 1: Source = Vendor alert AND score ≥ 75 → Route to [subprocessor breach inbox](/designing-subprocessor-breach-notification-and-cascade-impact-ui-in-figma/) · Create VIN-* record
├── Rule 2: Source = Internal security AND special category = Yes → Auto Critical · Page DPO + CISO
├── Rule 3: Score ≥ 55 AND region includes EU → Start 72h awareness clock widget · Link regulator tracker
├── Rule 4: Linked enterprise tenant count ≥ 1 → Create CSM task · B2B notification segment
├── Rule 5: User report volume > 50/hr on same topic → Link [privacy request queue](/designing-privacy-request-queue-and-case-management-ui-in-figma/) · Bulk template
├── Rule 6: SLA breach on triage (no assignee in 2h Critical) → Escalate to privacy lead · Log [audit event](/designing-audit-log-and-security-activity-ui-in-figma/)
└── Override: All auto-actions visible in incident timeline · Human can undo with reason

Rules should be transparent and editable—privacy teams change thresholds after each post-incident review.

Triage decision panel

TriageDecision — PIN-1044 · Assignee: @legal · SLA: 1h 14m remaining
├── Recommended path (from rules): Escalate to subprocessor breach workflow · Confidence: High
├── Decision options:
│   ├── ○ Confirm personal data breach → Open [subprocessor breach](/designing-subprocessor-breach-notification-and-cascade-impact-ui-in-figma/) (VIN-993)
│   ├── ○ Likely incident, need investigation → Assign IR · Open [war room](/designing-security-operations-shift-handover-and-war-room-ui-in-figma/) optional
│   ├── ○ Policy issue, no breach → Route to [privacy remediation](/designing-privacy-impact-remediation-tracking-and-action-plan-ui-in-figma/)
│   ├── ○ False positive → Archive with legal sign-off · Update [vendor risk](/designing-vendor-risk-assessment-and-third-party-reviews-ui-in-figma/)
│   └── ○ Duplicate → Merge into PIN-1040
├── Required fields: Decision · Rationale (min 50 chars) · Awareness timestamp if breach confirmed
├── Attachments: Vendor PDF · Screenshots · [Forensic refs](/designing-forensic-evidence-management-and-chain-of-custody-ui-in-figma/)
├── Notify: DPO ☐ · CISO ☐ · Comms ☐ · Customer success (B2B) ☐
└── On submit: Immutable decision log · Downstream workflow created · SLA closed

Awareness timestamp captured at triage decision starts regulator clocks—make it explicit, not implicit.

Comparison: triage vs adjacent workflows

Workflow	Starts when	This UI’s role
Privacy request queue	User submits DSAR/erasure	Triage may spawn linked queue spike
Subprocessor breach	Vendor alert confirmed breach	Auto-created from Critical vendor triage
Breach notification	First-party breach confirmed	Escalation target for internal Critical
War room	Active coordinated response	Optional link from High/Critical triage
PIR	Incident closed	Feed rubric threshold updates

Handoff checklist (Dev Mode)

PrivacyIncident — incident_id, source, created_at, severity_score, tier, status, assignee_id, awareness_at.
SeverityDimension — incident_id, dimension_key, weight, raw_score, rationale, assessed_by, assessed_at.
EscalationRule — rule_id, condition_json, action_type, target_workflow, enabled, priority.
TriageDecision — incident_id, decision_type, rationale, decided_by, decided_at, downstream_id.
IncidentSLA — incident_id, sla_type, deadline_at, breached_at, closed_at.
IncidentLink — incident_id, linked_type (war_room, vin, prq, remediation), linked_id.
Accessibility — Tier badges with text labels; SLA countdown announced to screen readers; keyboard-navigable decision radio group.

Common mistakes

Mistake	Why it hurts	Fix
No unified inbox	Alerts scattered across email and Slack	Single PIN-* queue with source tags
Subjective severity only	Inconsistent escalation	Weighted rubric wizard with override audit
Missing awareness timestamp	Wrong 72h clock	Capture at triage decision, not vendor email date
Auto-escalation is opaque	Teams distrust the tool	Show rule name and action in timeline
No false positive path	Cluttered queue forever	Archive flow with legal sign-off
Duplicate vendor + internal tickets	Split response	Merge UI with linked timeline
SLA with no breach escalation	Critical sits for hours	Auto-page privacy lead on SLA breach
Rubric never updated	Repeat misclassification	Link closed incidents to PIR rubric review task

Recommended workflow

Ingest all sources into one inbox—vendor webhooks, internal tickets, user reports, regulator mail.
Run severity rubric on every new incident within SLA; allow “insufficient info” with vendor chase task.
Apply auto-routing rules to create downstream records (VIN-*, war room, remediation) without manual copy-paste.
Capture triage decision with rationale and awareness timestamp before closing triage SLA.
Monitor SLA breaches on the posture dashboard as a privacy ops KPI.
Review rubric thresholds quarterly from PIR findings in Dev Mode.

FAQ

Triage vs security SOC queue?

Privacy triage focuses on personal data impact and regulatory obligations. Link to SOC tickets but do not duplicate full IR tooling—escalate to war room when coordination needed.

Can users submit incidents?

Support user report intake with lower default tier; spike detection rules link to privacy request queue when volume suggests coordinated concern.

Regulator inquiry as incident?

Yes—tag source Regulator; default High tier until assessed; link authority correspondence on response.

Score changed after new vendor data?

Support re-score with version history; if tier increases, retroactively start clocks from original awareness if already documented.

Integrate with subprocessor breach?

Vendor Critical triage should auto-create VIN-* with pre-filled rubric dimensions—avoid re-entering the same data.

Next steps

Design subprocessor breach notification and cascade impact UI in Figma — downstream workflow for vendor Critical incidents
Design breach notification and regulatory reporting UI in Figma — first-party breach escalation target
Design privacy request queue and case management UI in Figma — user report spikes after incidents
Design security operations shift handover and war room UI in Figma — coordinated response for High/Critical
Design post-incident review and root cause analysis UI in Figma — improve rubric thresholds after close

Designing privacy incident severity classification and triage UI in Figma: scoring rubrics, queues, and escalation paths