Personal Data Breaches

Even organisations with good controls can suffer a personal data breach. What matters is how quickly you identify it, contain it, assess the risks, and decide whether notification is required. Having a clear internal process in place can save vital time and help you demonstrate compliance with the UK GDPR’s accountability principle.

This collection is designed to be used together as a simple breach-handling toolkit: a policy to set out the steps, a report form for internal reporting, and a register to log breaches and document decisions and actions.

When Should You Use These Templates?

Use these templates if you want a practical way to manage data breaches from start to finish, including:

enabling staff to report suspected or actual breaches quickly and consistently;
containing and investigating the incident, and assessing whether the breach is likely to result in risk (or high risk) to individuals;
deciding whether you need to notify the ICO and, where necessary, affected individuals;
keeping a clear internal record of what happened and how you responded, including where you decide notification is not required.

What Templates Are Included?

Data Breach Guidance Notes

Guidance to help you understand and identify personal data breaches, spot common breach scenarios, and handle breaches in line with UK GDPR and the Data Protection Act 2018, including when notification may be required.

Data Breach Policy

A policy setting out the key stages for handling a breach, from internal reporting and initial containment through to investigation, notification decisions, and implementing preventative measures.

Data Breach Report Form

A staff-friendly reporting form to capture key facts early (for example, when it occurred and when it was discovered, what data is involved, what caused the breach, and how much data is affected). It can optionally be used for anonymous reporting if you have a suitable mechanism in place.

Data Breach Register

A register for recording the details of each breach and the key outcomes from following your breach procedure, including investigation findings and decisions on notification. Keeping a register supports the accountability principle and helps demonstrate that breaches are managed properly.

Why Use These Templates?

These documents are designed to support a repeatable, end-to-end process:

Report: staff capture the key facts quickly using the report form, so the right person can start managing the incident promptly.
Handle: the policy provides a clear workflow, from containment and assessment through to notification decisions and lessons learned.
Record: the register helps you document breaches and your response, including your reasoning where notification is not required.
Understand: the guidance notes help you interpret the requirements and apply them consistently.

For more information about each document in this collection, please click on the links below:

Personal Data Breaches is part of Business . Just £38.50 + VAT provides unlimited downloads from Business for 1 year.

Frequently Asked Questions

We think we have had a data breach, do we have to tell the ICO? +

You must report a personal data breach to the ICO without undue delay and within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms. So the trigger is your risk assessment, not the fact of a breach. If there is a risk you report, if there genuinely is not you do not, but either way you record it. The clock runs from awareness, so start assessing at once.

When do we have to tell the affected individuals? +

You must tell the affected people, without undue delay, where the breach is likely to result in a high risk to their rights and freedoms, for example a real chance of identity theft or financial loss. This is a higher bar than reporting to the ICO, so some breaches are reportable to the regulator but do not need to be told to individuals. Where you do notify people, use clear language and tell them what to do to protect themselves.

What actually counts as a personal data breach? +

More than hacking. A personal data breach is any security breach leading to accidental or unlawful destruction, loss, alteration or unauthorised disclosure of or access to personal data. That covers a lost or stolen laptop or phone, an email sent to the wrong person, records left on a train or a ransomware attack that locks up your data. If personal data is affected in any of these ways, treat it as a breach and assess it.

What if we miss the 72 hour deadline? +

Report anyway. If you notify the ICO late you must still do it and give reasons for the delay. It is better to report promptly and add detail later than to hold back a report while you complete the investigation, because you can provide information in phases. Missing the deadline is not a reason to stay silent, and a clear explanation of why you were late is part of a good faith response.

Do we need to keep a record even if we do not report? +

Yes. You must document every personal data breach, including the facts, the effects and the action you took, even where you decide it is low risk and does not need reporting. That record is how you demonstrate the accountability principle, and the ICO can ask to see it. A breach register is the practical tool, and keeping one also helps you spot patterns and improve your controls over time.

Business Buy Only £38.50 + VAT!
Unlimited Downloads for One Year
No Auto-Renewal

Complementary Templates

Rights and Transparency

All UK GDPR & Data Protection