Personal data breach log template
A simple log for personal data breaches, including the ones you decide not to report.
What the law asks you to keep
Art. 33(5) GDPR says the controller documents any personal data breach, comprising the facts relating to the breach, its effects and the remedial action taken. The columns below follow those three items, plus the notification decisions you will want to be able to explain later.
If you are a processor, Art. 33(2) says you notify the controller without undue delay after becoming aware of a breach. Your DPA with each customer usually adds a more specific deadline, so check it.
How to use it
- Add a row as soon as you learn about an incident, then fill in the rest as facts come in.
- Write what happened in plain facts. Leave opinions about blame for somewhere else.
- Record why you did or did not notify the supervisory authority or the people affected.
Example
The rows below are fictional and only show the format.
| ID | Detected (date and time) | Occurred (date and time, if known) | Facts: what happened | Data subjects affected (categories, approx. number) | Records affected (categories, approx. number) | Effects of the breach | Remedial action taken | Supervisory authority notified (date, or reason not) | Data subjects notified (date, or reason not) | Owner |
|---|---|---|---|---|---|---|---|---|---|---|
| EX-001 (fictional) | 2026-02-10 09:30 | 2026-02-09 22:00 | An exported customer list was shared by mistake with one other customer. | Customers, approx. 40 | Names and work email addresses, approx. 40 | Low: contact details only, one recipient who confirmed deletion | Link revoked, recipient confirmed deletion in writing, sharing check added to the export | Reason not notified: unlikely to result in a risk to individuals (see assessment note) | Not notified | Founder |
Download
Templates, not legal advice. Have your own counsel check anything you send to a customer.