Personal Data Breaches
Even organisations with good controls can suffer a personal data breach. What matters is how quickly you identify it, contain it, assess the risks, and decide whether notification is required. Having a clear internal process in place can save vital time and help you demonstrate compliance with the UK GDPR’s accountability principle.
This collection is designed to be used together as a simple breach-handling toolkit: a policy to set out the steps, a report form for internal reporting, and a register to log breaches and document decisions and actions.
When Should You Use These Templates?
Use these templates if you want a practical way to manage data breaches from start to finish, including:
- enabling staff to report suspected or actual breaches quickly and consistently;
- containing and investigating the incident, and assessing whether the breach is likely to result in risk (or high risk) to individuals;
- deciding whether you need to notify the ICO and, where necessary, affected individuals;
- keeping a clear internal record of what happened and how you responded, including where you decide notification is not required.
What Templates Are Included?
Data Breach Guidance Notes
Guidance to help you understand and identify personal data breaches, spot common breach scenarios, and handle breaches in line with UK GDPR and the Data Protection Act 2018, including when notification may be required.
Data Breach Policy
A policy setting out the key stages for handling a breach, from internal reporting and initial containment through to investigation, notification decisions, and implementing preventative measures.
Data Breach Report Form
A staff-friendly reporting form to capture key facts early (for example, when it occurred and when it was discovered, what data is involved, what caused the breach, and how much data is affected). It can optionally be used for anonymous reporting if you have a suitable mechanism in place.
Data Breach Register
A register for recording the details of each breach and the key outcomes from following your breach procedure, including investigation findings and decisions on notification. Keeping a register supports the accountability principle and helps demonstrate that breaches are managed properly.
Why Use These Templates?
These documents are designed to support a repeatable, end-to-end process:
- Report: staff capture the key facts quickly using the report form, so the right person can start managing the incident promptly.
- Handle: the policy provides a clear workflow, from containment and assessment through to notification decisions and lessons learned.
- Record: the register helps you document breaches and your response, including your reasoning where notification is not required.
- Understand: the guidance notes help you interpret the requirements and apply them consistently.
For more information about each document in this collection, please click on the links below:
Personal Data Breaches is part of Business . Just £38.50 + VAT provides unlimited downloads from Business for 1 year.