# Breach decision, notification and response record

Open this record as soon as an incident is identified. Log facts, timestamps, decisions and actions as they become known. Use a real incident response lead; a worksheet cannot monitor or submit a notification for you.

Document edition 2 — 1 November 2026

Organisation / activity: 
Owner: 
Reference and version: 
Review date: 

## 1. Establish the incident and awareness timeline

- Record discovery, escalation and the point at which the controller became aware, with timezone and evidence. Do not wait for a complete forensic investigation to consider awareness.
- Identify confidentiality, integrity and availability impacts, affected systems and whether personal information is involved.
- Assign an incident lead, deputy and decision authority; preserve evidence securely.

Incident ID / lead / deputy: 
Discovery date and time / timezone: 
Controller awareness date and time / evidence: 
72-hour notification milestone if applicable: 
Incident type / systems / initial facts: 
Evidence preservation and access record: 

## 2. Contain and assess impact on people

- Record containment, recovery and supplier actions with times and responsible people.
- Assess affected data, numbers, vulnerability, sensitivity, identifiability, protection measures, likely misuse and other harms.
- Separate established facts from assumptions. Reassess as evidence develops.

Affected data and approximate people / records: 
Categories of people and vulnerability: 
Likely consequences / likelihood / severity: 
Security protections and effectiveness: 
Containment and recovery actions: 
Uncertainty / enquiries / reassessment time: 

## 3. Decide and record regulator notification

- Notify without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to risk people’s rights and freedoms.
- Record the reasoned decision, including reasons not to notify. Record all personal data breaches.
- Prepare nature, scale, contact point, likely consequences and mitigation information. If information is incomplete, consider an initial report and phased updates without undue further delay.

Notify / do not notify / review pending: 
Risk assessment and decision reasons: 
Decision maker / time / advice: 
Notification content and submission evidence: 
Reason for delay if any: 
Supplementary updates and reference numbers: 

## 4. Decide affected-person communication

- Assess the high-risk threshold separately from regulator notification. Communicate without undue delay where required.
- Consider Article 34 exceptions on the actual facts and document any reliance. Disproportionate effort may require an equally effective public communication.
- Use clear language explaining the breach, likely consequences, measures, practical protective steps and contact route.

High-risk assessment: 
Direct communication required? Rationale: 
Any Article 34 exception and evidence: 
Audience / method / accessibility: 
Approved wording and practical advice: 
Issue date / delivery evidence / follow-up: 

## 5. Coordinate other notifications

- A processor must notify its controller without undue delay under Article 33(2); record contractual escalation routes.
- Check insurance, sector, customer and other contractual obligations. Coordinate appropriate cyber-response or crime reporting without delaying GDPR decisions.
- Maintain a single contact log so parallel communications remain consistent.

Controller / processor role and contacts: 
Processor notification time and evidence: 
Insurer and contractual deadlines: 
Other reporting routes and reasons: 
Communications owner and contact log: 
Advice and decision references: 

## 6. Learn, close and exercise

- Record root cause, final impact, remedial actions and verification. Define what remains open.
- Update training, contracts, technical controls and procedures as warranted.
- For a tabletop exercise, mark the scenario as simulated, record participants and test escalation, decisions and timing without sending real notifications.

Root cause and final assessment: 
Improvement action / owner / target date: 
Verification and closure decision: 
Evidence retention and access: 
Exercise or live-incident designation: 
Next exercise / review date: 

## Sources

- ICO: Personal data breach guidance: https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/
- UK GDPR Article 33: https://www.legislation.gov.uk/eur/2016/679/article/33
- UK GDPR Article 34: https://www.legislation.gov.uk/eur/2016/679/article/34