Free template

GDPR Data Breach Log Template

A free GDPR personal data breach log and 72-hour notification decision record, covering the facts, effects and remedial action that Article 33(5) requires controllers to document.

GDPR Article 33(5) requires controllers to document every personal data breach, including the facts, its effects and the remedial action taken, whether or not it is reported to the supervisory authority. The log is how you show a regulator that you assessed each breach properly.

Use one entry per breach and record decisions and their reasons as they are made. The 72-hour clock for notifying the authority starts when the organisation becomes aware of the breach.

How to use this template

Open a new entry as soon as a possible personal data breach is reported.
Record the time the organisation became aware; the 72-hour clock starts here.
Assess the risk to individuals and record whether you will notify the authority and the individuals, and why.
Record containment and remedial actions with owners and dates.
Close the entry after lessons learned are captured, and review the log at management review.

The template

Markdown opens in any editor and pastes into Word, Google Docs or Notion.

# Personal Data Breach Log

| Field | Entry |
| --- | --- |
| Breach reference | [BR-YYYY-001] |
| Date and time breach occurred (if known) | [YYYY-MM-DD hh:mm] |
| Date and time organisation became aware | [YYYY-MM-DD hh:mm]  (72-hour deadline: [YYYY-MM-DD hh:mm]) |
| Reported by | [Name, role] |
| How it was discovered | [Description] |
| Description of what happened | [Facts only] |
| Type of breach | [Confidentiality / Integrity / Availability] |
| Categories of personal data | [For example contact details, financial, health] |
| Special category data involved? | [Yes / No] |
| Approximate number of individuals | [Number] |
| Approximate number of records | [Number] |
| Categories of individuals | [Customers / Employees / Others] |
| Likely consequences for individuals | [Description] |
| Risk to individuals | [Unlikely / Risk / High risk] with reasoning |
| Containment actions taken | [Actions, owner, date] |
| Notify supervisory authority? | [Yes / No] and reason |
| Date and time authority notified | [YYYY-MM-DD hh:mm], reference [number] |
| Reason for any delay beyond 72 hours | [Explanation] |
| Notify affected individuals? | [Yes / No] and reason |
| Date individuals notified and method | [YYYY-MM-DD], [email / letter] |
| Processor involved? | [Name, date they notified us] |
| Remedial and preventive actions | [Actions, owner, due date] |
| Decision made by | [Name, role] |
| Lessons learned | [Summary] |
| Status | [Open / Closed], closed on [YYYY-MM-DD] |

## Risk assessment prompts
- Could the data be used for fraud, identity theft, discrimination or harm to reputation?
- Was the data encrypted or otherwise unintelligible to the recipient?
- Has the data been recovered or deleted, with confirmation?
- Are vulnerable individuals or children affected?

Frequently asked questions

Do you need to log GDPR breaches that are not reported?

Yes. Article 33(5) requires controllers to document all personal data breaches, including the facts, effects and remedial action, so the supervisory authority can verify compliance.

When does the GDPR 72-hour deadline start?

When the controller becomes aware of the breach, meaning it has a reasonable degree of certainty that a security incident has led to personal data being compromised.

Templates are general starting points, not legal advice. Adapt them to your organisation and check legal requirements for your jurisdiction.