Who it's for
- Small businesses and charities without an in-house data protection team
- Organisations that have just discovered a breach and need to act within 72 hours
- Anyone who wants a breach log ready before something goes wrong
What's included
- About this template — the 72-hour deadline, partial reports, record-keeping and when to tell individuals
- Document 1 — Internal breach assessment record: timings, nature, data affected, numbers, consequences, risk level, notification decisions and containment
- Document 2 — ICO notification record for your files, following the ICO's online report
- Document 3 — Individual notification letter: what happened, what data, what we are doing, what you should do, where to get help and how to contact us
Save with a bundle: get this plus 5 more documents in the GDPR + Data Protection Compliance Pack for £39.99.
See what's in the bundle →Key points covered
- Report to the ICO within 72 hours of becoming aware where a breach is likely to risk people's rights and freedoms
- You can submit a partial report and update it — do not delay to investigate fully
- Keep a record of every breach, including those you decide not to report
- Tell individuals without undue delay where the breach is likely to result in a high risk
- ICO reports are made online — the letter is for your records
DocPilot templates are drafted from current legislation and official guidance (GOV.UK, legislation.gov.uk and the relevant regulators), checked against those sources and fully re-reviewed every six months. They are not legal advice. How we make our documents →
Read the guide
Related documents
Data Processing Agreement£14.99 · See what's included →Privacy Policy (UK GDPR)£12.99 · See what's included →Cookie Policy£9.99 · See what's included →
Questions
When does the 72-hour clock start?
When your organisation becomes aware of the breach. Document 1 records that time and works out the deadline.
Do I have to report every breach?
No, only those likely to result in a risk to individuals. But you must record every breach and your reasons, which Document 1 does.
Can I send the ICO letter by post?
The ICO takes breach reports online. Document 2 is a record of what you submitted, for your files.
Is it in the GDPR + Data Protection Compliance Pack?
Yes. The Data Breach Notification Letter Pack is one of the 6 documents in the pack.
Data Breach Notification Letter Pack
£12.99 · Word + PDF · instant download
Buy — £12.99 →Bought the wrong document by genuine mistake? Our Swap or Refund Promise lets you swap it or get a refund within 14 days.