Chronologies
How to put events in order
Short answer
- Minimum columns, Qatar court guidance
- Date, Facts or Event, Disputes, E-Bundle reference 5
- Document link rule, New Zealand
- Each entry links to supporting documents 6
- Uncertain date notation
- EDTF ? ~ and % qualifiers 2
- Time reference
- UTC recommended for interoperability in RFC 3339 3
- File time risk
- Copying resets creation time 4
- Law over time
- Revised and as enacted versions on legislation.gov.uk 1
Step 1. Gather each dated item with its source
Start with a table, not a narrative. Qatar's international court asks for at least four columns, from left to right: Date, Facts or Event, Disputes, and E-Bundle reference 5. New Zealand's High Court requires each chronology entry to link to the documents that support it 6.
Include key events, not every event. New Zealand's Ministry of Justice describes a chronology as outlining the key events and facts a party intends to establish 6. Qatar's guidance says it should be no longer than is necessary 5.
Step 2. Record how precise each date is
A letter dated to the day and a memory placed in a season are not equal. The Extended Date/Time Format lets a record say so. A question mark marks a date as uncertain, a tilde marks it as approximate, and a percent sign marks both 2. An X can stand for an unspecified digit, and a double dot marks an open start or end 2.
When two events share a month but one has no day, keep them apart in the table rather than guessing a day. EDTF records 2004-06 as a month value without a day 2.
Step 3. Put machine times on one clock
RFC 3339 says interoperability is best achieved by using Coordinated Universal Time 3. A time with an offset, such as 1996-12-19T16:39:57-08:00, is the same instant as 1996-12-20T00:39:57Z 3. The calendar date changes, so convert before sorting.
Where the local offset is unknown, RFC 3339 allows -00:00 to say so 3. Mark such entries in the table instead of assuming a zone.
Step 4. Test the dates before relying on them
- Copy dates. NIST says copying a file to a system sets its creation time to the copy time 4.
- Clock errors. NIST says a computer clock may be incorrect or not synchronised with an authoritative time source 4.
- Missing detail. Some recorded times omit seconds or minutes 4.
- Alteration. NIST says an attacker may have altered recorded file times 4.
- Correlation. NIST notes that analysis often means correlating data among multiple sources 4.
Step 5. Separate the event from when it was known
Many legal clocks start from knowledge, not from the event. Under the GDPR, the 72-hour notice period starts when a controller becomes aware of a breach, which the EDPB ties to a reasonable degree of certainty that personal data was compromised 7. A chronology that holds only the breach date cannot show whether notice was in time.
Give each a separate row. The event, the first alert, and the point of awareness 7.
Step 6. Date the law as well as the facts
The rule that applied on a date may differ from today's text. legislation.gov.uk publishes an as enacted version shortly after enactment and a Latest Available (Revised) version that incorporates amendments made by later legislation 1.
An Act may come into force immediately, on a specific future date, or in stages 1. The site says its enacted versions do not give information about commencement, and unapplied effects are flagged in a Changes to Legislation banner 1. Record the version and commencement date used for each rule in the chronology.
Step 7. Mark what is agreed and what is disputed
Qatar's guidance says disagreements should be shown in neutral terms with the competing versions shortly stated 5. New Zealand's merged chronology shows which entries are agreed and which are disputed 6. A public inquiry panel sets out findings of fact but has no power to determine civil or criminal liability under the UK Inquiries Act 2005 8.
Common questions
What columns should a chronology have?
Qatar's international court requires at least Date, Facts or Event, Disputes, and E-Bundle reference 5.
How do I show a date I am not sure about?
In EDTF, add ? for uncertain, ~ for approximate, or % for both 2.
Should I convert times to UTC?
RFC 3339 says interoperability is best achieved by using UTC 3.
Can I trust a file's creation date?
Not on its own. NIST says copying resets creation time and clocks may be wrong 4.
How do I know which version of a law applied on a date?
legislation.gov.uk separates as enacted and revised versions and flags unapplied effects 1.
Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@sequenceofrecord.com.
Sources
- legislation.gov.uk: Understanding Legislation
- Library of Congress: Extended Date Time Format (EDTF) Specification (4 February 2019)
- IETF: RFC 3339, Date and Time on the Internet: Timestamps (July 2002)
- NIST: Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response (August 2006)
- Qatar International Court: Guidance on Chronologies and Dramatis Personae (April 2023)
- New Zealand Ministry of Justice: Preparing for trial General Proceedings
- European Data Protection Board: Guidelines 9/2022 on personal data breach notification under GDPR, Version 2.0 (28 March 2023)
- legislation.gov.uk: Inquiries Act 2005, section 2, No determination of liability
Related
- Agreed chronologies in litigation
How courts in England and Wales, New Zealand, Qatar and Australia ask parties to prepare an agreed chronology, and how disputed dates are shown.
- Date precision and uncertainty
How the Extended Date/Time Format and RFC 3339 record approximate, uncertain, partial and open-ended dates, with examples from the specifications.
- Electronic timestamps explained
What file times, log times and trusted time-stamp tokens record, why they can be wrong, and what NIST, IETF and CERT-In guidance says about them.
- Public inquiry chronologies explained
How public inquiries gather dated evidence, publish it, set out the order of events in reports, and why their findings are not rulings on liability.
- The GDPR 72-hour breach clock explained
When the GDPR 72-hour breach clock starts, what awareness means, what the notice must hold, and how other breach deadlines around the world compare.
- Chain of custody explained
What a chain of custody record shows, how hashes and preserved file times protect digital evidence, and what NIST and IETF guidance says about each step.