Personal Data Breach Assessment Template (GDPR Art. 33 and 34)

Personal Data Breach Assessment: [Breach reference and short name]

Assessment and decision record for a personal data breach under Articles 33 and 34 of the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR, applicable since 25 May 2018) and the European Data Protection Board (EDPB) Guidelines 9/2022 on personal data breach notification under GDPR, version 2.0 adopted on 28 March 2023. It covers triage, the Article 4(12) breach test, the risk assessment for individuals, the decision to notify the supervisory authority (Article 33) and to communicate with data subjects (Article 34), draft notification texts, other notification regimes, and the entry in the breach log required by Article 33(5). UK GDPR and United States examples are included as dated pointers. Replace every [bracketed] value and every row marked Example. Check the consolidated GDPR text, current EDPB guidance and your supervisory authority's notification form before use. This is a documentation format, not legal advice; check the current official text and consult a qualified professional.

Document control

Approvals

Revision history

Contents

1. Detection, awareness and timeline
2. Breach description
3. Containment and recovery
4. Risk assessment for individuals
5. Notification decision
6. Notification to the supervisory authority (Article 33)
7. Communication to data subjects (Article 34)
8. Processors, joint controllers and recipients
9. Other notification regimes
10. Breach log entry (Article 33(5))
11. Lessons learned and actions
12. Glossary and references

1. Detection, awareness and timeline

The EDPB guidelines treat a controller as aware when it has a reasonable degree of certainty that a security incident has led to personal data being compromised. A short initial investigation to establish that certainty is expected, and it should start promptly. Record the reasoning for the chosen awareness time, because it is the start of the 72-hour window in Article 33(1).

1.1 Timeline

In the example, awareness was established 5 hours 30 minutes after the first report, the Article 33 deadline was 2026-03-05 15:10 UTC, and the initial notification went out 43 hours 50 minutes after awareness, inside the window. The follow-up notification came 9 days and 50 minutes after awareness, as a phased notification under Article 33(4).

2. Breach description

2.1 Breach test

The three breach types follow the information security model used by the EDPB: a confidentiality breach is unauthorised or accidental disclosure of or access to personal data, an integrity breach is unauthorised or accidental alteration, and an availability breach is accidental or unauthorised loss of access to, or destruction of, personal data. One event can be all three.

2.2 Data and data subjects

Record where the data subjects live (Member State or country), because it decides which authorities may need to hear from you (section 5.3) and which other laws may apply (section 9). In the example the learners live in four Member States.

2.3 Systems, parties and source

3. Containment and recovery

Questions to answer before section 4:

• Can the data still be accessed, altered or destroyed by anyone unauthorised?
• Is there evidence the data was copied, and by whom?
• Can lost data be restored from a backup, and how complete is the restore?
• Were the data encrypted, and was the key also exposed?

4. Risk assessment for individuals

4.1 Factors

4.2 Scoring method

The scale below is an internal method written for this template, not a regulatory threshold. Replace it with your organisation's method in compliance/risk-methodology if one exists, and document the reasoning in words, not only the score.

Risk level = severity x likelihood: 1 to 3 is "unlikely to result in a risk", 4 to 8 is "risk", 9 to 16 is "high risk". Treat these bands as a prompt for judgement, not a substitute for it.

4.3 Assessment by group

Overall result: [Unlikely to result in a risk / Risk / High risk for groups [list]]. In the example, the breach must be notified to the supervisory authority (risk for all learners), and DSG-02 meets the high-risk test for communication to data subjects.

5. Notification decision

5.1 Supervisory authority (Article 33)

5.2 Data subjects (Article 34)

The supervisory authority can require communication to data subjects if it considers the high risk likely, or can decide that one of the Article 34(3) conditions is met (Article 34(4)). Keep the decision open to revision as facts change.

5.3 Which authority

5.4 DPO advice

[Record the DPO's advice, whether it was followed, and if not, why.]

6. Notification to the supervisory authority (Article 33)

6.1 Draft initial notification text

Example: On 2 March 2026 at 09:40 UTC, Quillmere Learning Ltd received a report from an external security researcher that a cloud storage location holding exports of learner records was publicly readable. We confirmed at 15:10 UTC that the location held personal data and removed public access at 15:25 UTC. About 18,400 learners in four Member States are concerned, with 18,400 records. For 1,150 of them the files include notes on disability-related study adjustments (health data). Access logs show the location was listed by three unidentified network addresses and that one of them downloaded the folder holding the adjustment notes. Likely consequences are targeted phishing for all learners and distress, discrimination or loss of confidentiality of health information for the 1,150 learners concerned. We have preserved logs, blocked public access across the account, obtained deletion confirmation from the researcher and will write directly to the 1,150 learners. Contact point: [DPO name, email, phone]. We will provide the results of the full log analysis by 13 March 2026.

6.2 Phased and follow-up notifications

7. Communication to data subjects (Article 34)

7.1 Draft message

Example:

Subject: Important information about your study adjustment records

Dear [Learner name],

We are writing to tell you about a security problem that affected some of your information held by Quillmere Learning. On 2 March 2026 we learned that a storage area holding copies of learner records had been set up incorrectly and could be read from the internet. We closed it the same day. The files included your name, email address, your courses and the notes about the study adjustments you asked us to provide. We know that an unidentified person downloaded these files.

This could mean that someone who should not know about your health needs now does, or that you receive emails pretending to be from us. We will never ask for your password by email. If you receive a message that looks like ours and asks for personal details, please forward it to [address] and do not reply.

We have fixed the setting that caused the problem, checked every other storage area for the same error and told the data protection supervisory authority. If you have questions or concerns, contact our data protection officer at [contact]. You also have the right to lodge a complaint with a supervisory authority.

[Name, role]

8. Processors, joint controllers and recipients

If this organisation is the processor, record when you told the controller, what you told them, and which support you offered, then stop: the notification decisions in sections 5 to 7 belong to the controller.

9. Other notification regimes

Proposed EU changes to watch: the Commission's Digital Omnibus proposal of November 2025 would, as reported, move Article 33 to a high-risk threshold, a 96-hour deadline and a single entry point for incident reporting. It was still a proposal when this template was written; check its status before relying on it.

10. Breach log entry (Article 33(5))

11. Lessons learned and actions

12. Glossary and references

12.1 Glossary

12.2 References

Links: EDPB guidelines https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-92022-personal-data-breach-notification-under_en ; GDPR on EUR-Lex https://eur-lex.europa.eu/eli/reg/2016/679/oj ; ICO guide https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ ; HHS breach notification https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html ; ENISA methodology https://www.enisa.europa.eu/publications/dbn-severity

Standard and licence note

Based on Regulation (EU) 2016/679 (GDPR) as published in the Official Journal of the European Union, and on EDPB Guidelines 9/2022 on personal data breach notification under GDPR, version 2.0 adopted on 28 March 2023. EU legislative texts and EDPB guidelines are public; article numbers are cited and obligations are summarised in original wording, and no guideline text is reproduced. The UK and US rows are dated pointers, not complete summaries of those laws. The scoring scale, worked example, organisation, people and figures are fictional and written for this template. Check the consolidated GDPR text, the current EDPB guidance, your supervisory authority's form and any legislative changes (including the Digital Omnibus proposal) before use. This is a documentation format, not legal advice; consult a qualified professional. Template licence: MIT.