When the operator is a public body, the report is a public record
About this documentUpdated 2026-09-21ShowHide
Sean McDermott, Co-Founder and CEO, UnGovr
Written by Sean McDermott (with AI assistance) using the LexLint law library, which supplied every legal instrument, status and date on these pages.
Every law named here links to its summary page on lexlint.org, translated to English (if needed) and restructured to a standard format for human and code use. Every case links to the court's or the regulator's own record where one could be reached.
© 2026 UnGovr, publishing as LexLint. The text and the figures are licensed under Creative Commons Attribution-ShareAlike 4.0: share and adapt them, including commercially, with credit to LexLint (UnGovr) and under the same licence. Please contact LexLint at hello@ungovr.org to discuss other terms. Logos and wordmarks belong to their owners.
Corpus figures as of 2026-09-21.
Legal information, not legal advice. This document describes the law as written and dated; it does not apply it to any system. The notice at the foot says what that means.
A water utility, a transit agency, a public hospital or a ministry that runs an agent holds its incident report, the notices it sent and the notices it received as public records. Under most public-records acts a record is released on request unless an exemption covers it, on a deadline counted in days. Which grounds the acts carry, whether the body must or may withhold, how fast it has to answer, and what that means for the body, for its vendor and for anyone who sends it an alert.
1What this document is
The documents before this one ask which reports an incident makes due, to whom and by when. This one asks what happens to those reports afterwards when the OPERATOR is a public body. A great many operators of agents are: utilities, transit agencies, hospitals, schools, ministries and the local governments UnGovr indexes. Each holds its records under a public-records act, and an incident produces records: the notice to the regulator, the notice to the people affected, the internal report, the vendor's report, the alert a third party sent when its own system reached the body's.
It is written for three readers. The team building or running an agent inside or for a public body, which will write those records. The vendor whose incident report lands in a public body's files. And anyone who sends an incident alert to a public body expecting it to stay confidential. The law it reads is UnGovr's public-records corpus, 398 acts in 144 countries on 2026-09-21, which lives on law.ungovr.org because a records act is law about what a government must disclose. This page reads those acts for one thing, what they do to a software operator's incident record, and links each act to its own page rather than restating it.
A record a public body holds is released on request unless an exemption covers it, on a deadline counted in days. A confidentiality promise made to the body, or by it, does not change that; only the act's own exemptions do, and whether the body must or may use one is the act's to say.
2What becomes a record
A records act reaches what a body holds, however it came to hold it. An incident involving an agent leaves at least these, and each is held by the body from the moment it exists there.
| The record | Written by | Why the body holds it |
|---|---|---|
| The notice to a regulator, and any final report | The body | It sent it; the copy and the drafts are its records |
| The notice to the people affected | The body | The same, and the list of who was told is a record of its own |
| The internal incident report and its timeline | The body's staff | Created in the course of its business |
| The vendor's report to its public-sector customer | The MAKER or a contractor | Received by the body; a record on receipt, whatever the contract says about confidentiality |
| An alert from a third party whose agent reached the body's systems | The COUNTERPARTY | Received by the body, so held by it, before any de-identified version is written |
| The agent's own traces and logs | The system | Held by the body, and the classes What you must be able to show describes are what a requester can ask for by name |
3The grounds an act can withhold on, and how often they exist
Every act in the corpus lists its exemptions. Five of them bear on an incident record, and the table counts how many acts carry each, read by a test on the words of each act's own exemption list. Where an exemption states whether the body must withhold or may withhold, that is counted too; an act whose entry does not say is counted as unstated. The test is words, not a reading of the statute, so every count is a floor, and the words are printed under the table so the test can be checked.
| Ground | Acts with such a ground | Must withhold | May withhold | Not stated |
|---|---|---|---|---|
| Security and critical infrastructure | 239 | 75 | 61 | 103 |
| Investigations and law enforcement | 192 | 39 | 58 | 95 |
| Trade secrets and commercial confidence | 212 | 41 | 66 | 105 |
| Personal data and privacy | 242 | 76 | 67 | 99 |
| Drafts and deliberations | 141 | 22 | 56 | 63 |
| Acts in the corpus | 398 |
The words: security and critical infrastructure matches secur, cyber, infrastructure, defenc or se, vulnerab, incident, seguran, seguridad, sécurité, sicherheit; investigations and law enforcement matches investigat, law enforcement, prosecut, police, crimin, policial, penal; trade secrets and commercial confidence matches trade secret, commercial, business, proprietary, competitive, comercial, empresarial, geschäfts, betriebs; personal data and privacy matches personal, privacy, private life, pessoa, datos personales, données personnelles, personenbezogen, vie privée; drafts and deliberations matches draft, deliberat, preliminary, preparatory, working paper, pre-decisional, decision-making, advice, prepara. Matched against an exemption's name, description and subcategories, in any of the languages the corpus records an act in.
What the table says for an incident record. Security is the ground most people expect and it is not universal: an act with no security or infrastructure ground has nothing but the general grounds to withhold a description of how a system was compromised. A vendor's report rests on the commercial ground, which protects trade secrets and information given in confidence, and which in most acts the body may use rather than must, often after weighing the public interest. The people in the data are the one interest nearly every act protects, so the names and details of affected people are the part of a report most reliably withheld, and the fact of the incident the part least. A draft is protected only while it is a draft: several acts release preparatory documents once the decision they informed has been taken. And a mandatory ground is withheld whoever asks; a discretionary one is a decision the body makes, record by record, that a requester can appeal.
Two rules run under all five. Most acts require the body to release the parts of a record no exemption covers, so a report is not withheld whole because one paragraph is exempt. And the exemptions belong to the act, not to the parties: a clause in a vendor's contract, or a confidentiality line at the top of an alert, is not an exemption. Where an act protects information supplied in confidence, it is the act's test the body applies, and in some acts the body must consult the supplier, or a state officer, before it decides.
4How soon the body has to answer
363 of the 398 acts state a fixed number of days for the first response; the rest say prompt, reasonable or without delay, and a few set no request procedure at all. Among the fixed ones the shortest is immediate, the median is 20 days, the longest is 120 days, and 68 acts require an answer within ten days. Many allow an extension, shown after the plus sign below. So a confidential alert or report sent to a public body can lawfully be in a requester's hands within days, before any voluntary scheme's own report is due: the SAFE proposal that Incident reporting clocks draws puts its public report at thirty days, and an act with a ten-day deadline does not wait for it.
The acts the rest of this section leans on, each linked to its page on law.ungovr.org, which carries the exemptions in full, the appeal route and the fees. In the grounds columns, must is a mandatory exemption, may a discretionary one, and yes a ground whose entry does not say which.
| Place | The act | Answer due | Security | Enforcement | Commercial | Personal | Drafts |
|---|---|---|---|---|---|---|---|
 United States |
Freedom of Information Act | 20 days + 10 | must | may | must | may | may |
 California |
California Public Records Act | 10 days + 14 | may | may | must | may | may |
 Texas |
Texas Public Information Act | 10 days | may | must | must | may | |
 New York |
Freedom of Information Law | 5 days + 20 | yes | yes | yes | yes | yes |
 United Kingdom |
Freedom of Information Act 2000 | 20 days + 20 | must | may | may | must | may |
 Ireland |
Freedom of Information Act 2014 | 20 days + 20 | must | may | must | must | may |
 Germany |
Informationsfreiheitsgesetz (Freedom of Information Act) | 30 days | must | must | must | yes | may |
 France |
Code des relations entre le public et l'administration (CRPA) | 30 days | must | must | may | must | must |
 Netherlands |
Open Government Act (Wet open overheid / Woo) | 28 days + 14 | must | must | must | may | |
 Spain |
Ley de Transparencia, Acceso a la Informacion Publica y Buen Gobierno | 30 days + 30 | yes | yes | yes | yes | yes |
 Italy |
Accesso Civico Generalizzato (Generalized Civic Access) | 30 days + 10 | yes | yes | yes | yes | |
 Canada |
Access to Information Act | 30 days | may | may | must | must | may |
 Australia |
Freedom of Information Act 1982 | 30 days + 30 | must | may | may | may | may |
 Brazil |
Lei nº 12.527/2011 — Lei de Acesso à Informação | 20 days + 10 | must | must | must | ||
 India |
Right to Information Act, 2005 | 30 days | must | may | may | may | may |
 Japan |
Act on Access to Information Held by Administrative Organs | 30 days + 30 | must | must | must | must | must |
 South Korea |
Official Information Disclosure Act | 10 days + 10 | may | may | may | may | may |
 Mexico |
Ley General de Transparencia y Acceso a la Información Pública | 20 days + 10 | must | may | must | must | may |
 South Africa |
Promotion of Access to Information Act (PAIA) | 30 days + 30 | yes | yes | yes | yes | yes |
 Kenya |
Access to Information Act | 21 days + 14 | yes | yes | yes | yes |
Every act in the corpus, by region: 398 acts, 144 national and 254 subnational in 13 countries
EU member states (the national layer): 60
Austria
Belgium
Bulgaria
Cyprus
Czech Republic
Denmark
Estonia
Finland
Greece
Croatia
Hungary
Lithuania
Luxembourg
Latvia
Malta
Poland
Portugal
Romania
Sweden
Slovenia
SlovakiaUnited Kingdom: 2
| Place | The act | Answer due | Security | Enforcement | Commercial | Personal | Drafts |
|---|---|---|---|---|---|---|---|
| United Kingdom |
Freedom of Information Act 2000 | 20 days + 20 | must | may | may | must | may |
| Scotland | Freedom of Information (Scotland) Act 2002 | 20 days + 20 | must | may | must |
United States, federal: 1
| Place | The act | Answer due | Security | Enforcement | Commercial | Personal | Drafts |
|---|---|---|---|---|---|---|---|
| United States |
Freedom of Information Act | 20 days + 10 | must | may | must | may | may |
United States, states: 56
| Place | The act | Answer due | Security | Enforcement | Commercial | Personal | Drafts |
|---|---|---|---|---|---|---|---|
 Alaska |
Alaska Public Records Act | not fixed | yes | yes | yes | yes | |
 Alabama |
Alabama Open Records Act | not fixed | yes | yes | yes | ||
 Arkansas |
Arkansas Freedom of Information Act | not fixed | yes | yes | yes | ||
 American Samoa |
American Samoa Public Records Provisions | not fixed | yes | ||||
 Arizona |
Arizona Public Records Law | not fixed | yes | yes | yes | yes | yes |
| California |
California Public Records Act | 10 days + 14 | may | may | must | may | may |
 Colorado |
Colorado Open Records Act | 3 days + 7 | yes | yes | yes | ||
 Connecticut |
Connecticut Freedom of Information Act | 4 days + 1 | yes | yes | yes | yes | yes |
 District of Columbia |
District of Columbia Freedom of Information Act | 15 days + 10 | yes | yes | yes | yes | yes |
 Delaware |
Delaware Freedom of Information Act | not fixed | yes | yes | yes | yes | yes |
 Florida |
Florida Public Records Law | not fixed | yes | yes | yes | yes | |
 Georgia |
Georgia Open Records Act | 3 days | yes | yes | yes | yes | |
 Guam |
Guam Sunshine Reform Act | 10 days | yes | yes | yes | yes | yes |
 Hawaii |
Hawaii Uniform Information Practices Act | not fixed | yes | yes | yes | yes | |
 Iowa |
Iowa Open Records Act | not fixed | yes | yes | yes | yes | |
 Idaho |
Idaho Public Records Act | not fixed | yes | yes | yes | yes | yes |
 Illinois |
Illinois Freedom of Information Act | 5 days + 5 | may | may | must | must | may |
 Indiana |
Indiana Access to Public Records Act | not fixed | yes | yes | yes | yes | |
 Kansas |
Kansas Open Records Act (KORA) | not fixed | yes | yes | yes | yes | |
 Kentucky |
Kentucky Open Records Act | 5 days | yes | yes | yes | yes | yes |
 Louisiana |
Louisiana Public Records Act | 3 days | yes | yes | |||
 Massachusetts |
Massachusetts Public Records Law | 10 days + 15 | yes | yes | yes | yes | yes |
 Maryland |
Maryland Public Information Act | 30 days + 30 | yes | yes | yes | ||
 Maine |
Maine Freedom of Access Act | not fixed | yes | yes | yes | yes | yes |
 Michigan |
Michigan Freedom of Information Act | 5 days + 10 | yes | yes | yes | yes | yes |
 Minnesota |
Minnesota Government Data Practices Act | not fixed | yes | yes | yes | ||
 Missouri |
Missouri Sunshine Law | 3 days | yes | yes | |||
 Northern Mariana Islands |
CNMI Open Government Act | 10 days + 10 | yes | yes | yes | yes | yes |
 Mississippi |
Mississippi Public Records Act | not fixed | yes | yes | yes | ||
 Montana |
Montana Public Records Act / Right to Know | not fixed | yes | yes | yes | yes | yes |
 North Carolina |
North Carolina Public Records Law | not fixed | yes | yes | yes | yes | |
 North Dakota |
North Dakota Open Records Law | not fixed | yes | yes | |||
 Nebraska |
Nebraska Public Records Act | not fixed | yes | yes | yes | yes | yes |
 New Hampshire |
New Hampshire Right to Know Law | not fixed | yes | yes | |||
 New Jersey |
New Jersey Open Public Records Act | 7 days + 7 | yes | yes | yes | yes | yes |
 New Mexico |
New Mexico Inspection of Public Records Act | 3 days + 15 | yes | yes | yes | ||
 Nevada |
Nevada Public Records Act | not fixed | yes | yes | yes | yes | |
| New York |
Freedom of Information Law | 5 days + 20 | yes | yes | yes | yes | yes |
 Ohio |
Ohio Public Records Act | not fixed | may | may | must | may | |
 Oklahoma |
Oklahoma Open Records Act | not fixed | yes | yes | yes | ||
 Oregon |
Oregon Public Records Law | not fixed | yes | yes | yes | yes | |
 Pennsylvania |
Pennsylvania Right-to-Know Law | 5 days + 30 | yes | yes | yes | yes | yes |
 Puerto Rico |
Transparency and Expedited Access to Public Information Act | 10 days + 10 | yes | yes | yes | yes | yes |
 Rhode Island |
Rhode Island Access to Public Records Act | 10 days | yes | yes | yes | ||
 South Carolina |
South Carolina Freedom of Information Act | not fixed | yes | yes | yes | yes | |
 South Dakota |
South Dakota Open Records Law | 10 days | yes | yes | |||
 Tennessee |
Tennessee Public Records Act | 7 days | yes | yes | yes | yes | |
| Texas |
Texas Public Information Act | 10 days | may | must | must | may | |
 Utah |
Utah Government Records Access and Management Act | 10 days | yes | yes | |||
 Virginia |
Virginia Freedom of Information Act | 5 days + 7 | yes | yes | yes | ||
 U.S. Virgin Islands |
Virgin Islands Open Records Act | not fixed | yes | yes | yes | yes | |
 Vermont |
Vermont Public Records Act | 10 days + 10 | yes | yes | |||
 Washington |
Washington Public Records Act | 5 days | yes | yes | yes | yes | yes |
 Wisconsin |
Wisconsin Public Records Law | not fixed | yes | yes | |||
 West Virginia |
West Virginia Freedom of Information Act | not fixed | yes | yes | |||
 Wyoming |
Wyoming Public Records Act | not fixed | yes | yes | yes |
Asia and the Pacific: 65
Afghanistan
Bangladesh
China
Fiji
Indonesia
Kyrgyzstan
Kazakhstan
Sri Lanka
Mongolia
Nepal
New Zealand
Philippines
Pakistan
Thailand
Tajikistan
Taiwan
Uzbekistan
VietnamThe Americas outside the United States: 117
Argentina
Bolivia
Bahamas
Belize
Chile
Colombia
Costa Rica
Dominican Republic
Ecuador
Guatemala
Guyana
Honduras
Jamaica
Nicaragua
Panama
Peru
Paraguay
El Salvador
Trinidad and Tobago
Uruguay
VenezuelaAfrica, the Middle East and elsewhere: 97
Andorra
United Arab Emirates
Antigua and Barbuda
Albania
Armenia
Angola
Azerbaijan
Bosnia and Herzegovina
Burkina Faso
Benin
Bermuda
Belarus
Switzerland
Côte d'Ivoire
Cook Islands
Cabo Verde
Ethiopia
Georgia
Ghana
Gambia
Guinea
Israel
Iran
Iceland
Jordan
Saint Kitts and Nevis
Kuwait
Cayman Islands
Lebanon
Liechtenstein
Liberia
Morocco
Monaco
Moldova
Montenegro
North Macedonia
Maldives
Malawi
Mozambique
Namibia
Niger
Nigeria
Norway
Palau
Qatar
Serbia
Russia
Rwanda
Saudi Arabia
Seychelles
Sudan
Sierra Leone
San Marino
Senegal
South Sudan
Togo
Timor-Leste
Tunisia
Turkey
Tanzania
Ukraine
Uganda
Vanuatu
Kosovo
Yemen
Zambia
Zimbabwe5How long the record lasts
A records act reaches a record for as long as the body holds it, and how long that is comes from a different law: the body's records retention statute and the schedule made under it. The corpus records the retention law beside 102 of the 398 acts. Under those schedules an incident report is kept for a stated period, then archived or destroyed, and it can be requested at any point in between. That period is set by the body's status as a public body and has nothing to do with the retention periods the incident law itself states, which What you must be able to show lists; where the two differ, the longer one governs how long the record exists to be asked for.
6What follows for each party
Three readers, three consequences
- The public body
- Write the report assuming it will be read, and write it so the parts that must be withheld are separable from the parts that will not be: the names of people in one place, the description of the compromise in another, the timeline in a third. Know which of the five grounds your act carries, whether each is a must or a may, and the day count, before the incident rather than during it.
- The vendor
- A report sent to a public-sector customer is that customer's record. The commercial ground is the protection, it is usually discretionary, and in some acts it applies only to material marked or claimed as confidential at the time it is supplied. The contract's confidentiality clause binds the customer as a party and does not bind the act.
- The sender of an alert
- An alert sent to a public body is held by it from receipt, so the protection available is what the alert contains, not a promise about who will read it. A scheme that shares incident findings among members should assume that a member subject to a records act can be made to release what it was sent, and send that member the de-identified version only.
None of this is an argument for less disclosure or for more. It is what the acts say, and the section's own rule is that a system whose operator is a public body is a system whose incident record has a second reader the private operator's does not.
7What the corpus does not hold
No supranational act: the regime that governs access to documents held by the European Union's own institutions is not in the corpus, so a report held by a Union body is outside this page. Subnational acts are recorded for 13 countries; in the others a subnational body answers under the national act, or under a law the corpus has not reached. The grounds are a test on words and a floor: an act whose exemption list names a ground in words the test does not carry is counted as lacking it. And the corpus records the act, not the case law under it, which in many places is where the security ground's real width is decided.
8What this document does not claim
It does not say whether any particular report will be released or withheld. That is the body's decision under its act, reviewed by the act's appeal body or a court, and the grounds counted above are read from the acts' own lists on the date in the byline, not from a reading of any request. The deadlines are the acts' stated first-response periods, and a body may take an extension or miss the day. Nothing here is legal advice.