What this review helps you do
A breach-response record should establish what happened, when the organisation became aware, the possible effects on people and the decisions taken. Keep containment, risk assessment and notification under active ownership; waiting for a complete investigation does not pause an applicable legal deadline.
AT A GLANCE
Know who acts, when to escalate and what evidence to preserve. Test a response plan before an incident becomes a deadline.
The legal position
A personal data breach can affect confidentiality, integrity or availability. It includes accidental loss or alteration as well as unauthorised disclosure or access.
A controller must notify the regulator without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to risk people’s rights and freedoms. Explain any late notification.
Inform affected people without undue delay where a breach is likely to create a high risk, subject to Article 34’s conditions and exceptions.
Record all personal data breaches, including the assessment and reasons when notification is unnecessary. A processor must notify its controller without undue delay under Article 33(2).
What to review
- Identify a response lead, deputy, out-of-hours contact and escalation route for staff and suppliers.
- Record discovery, controller awareness, affected systems and people, impact, containment and recovery.
- Test regulator and individual notification decisions separately; do not equate financial loss with the only possible harm.
- Coordinate insurers, specialist responders, contractual notifications and relevant cybercrime reporting without delaying statutory decisions.
- Run a tabletop scenario such as a misdirected patient record or ransomware affecting client files; log follow-up actions.
Working outputs
- Breach response plan and escalation card
- Breach register and reasoned decision log
- Regulator and affected-person draft notification checklists
- Tabletop exercise report and improvement tracker
PUT THIS GUIDE TO WORK
Review it. Record it. Keep the evidence.
Open the relevant assessment area or complete the matching working document.
Evidence checklist
Use these checks to gather references and identify the evidence that still needs testing.
- Do staff know how to report suspected incidents immediately?
- Is an accountable person available outside office hours?
- Can we identify when awareness occurred and the notification deadline?
- Are decisions based on risk to individuals and recorded?
- Have we tested notification and recovery arrangements with key processors?
Implementation tip
Start a contemporaneous decision log immediately. Record what was known at each decision point. An initial regulatory report can be supplemented; waiting for a complete forensic report can cause delay.
Apply the limits carefully
A checklist cannot decide whether a particular incident is notifiable. The controller must make and document the assessment; urgent incidents need live professional judgement.
Common misunderstandings
Article 33(2) requires a processor to notify its controller without undue delay after awareness of a personal data breach. Article 28(3)(f) addresses the processor’s contractual assistance obligations.
The 72-hour notification period runs from the controller’s awareness, includes weekends and does not wait for the investigation to finish.
An internal action-plan target cannot extend a statutory notification period. Manage the legal timing separately from longer-term remediation.
Worked example: a misdirected attachment
Illustrative scenario. This is a fictional teaching example, not a client case, professional finding or verified outcome.
In a fictional professional practice, a worker reports sending an attachment containing personal information to an unintended recipient. The example does not predetermine whether notification is required.
- Control
Staff should escalate suspected incidents promptly so that an authorised incident lead can assess containment, risk and any notification obligations.
- Evidence
Record the relevant timestamps, type of information, intended and actual recipients, containment attempts and reliable evidence of access or deletion.
- Finding
The initial log says only 'email recalled'. It does not establish whether the recipient accessed the attachment or record a reasoned risk decision.
- Owner and action
The incident lead investigates promptly, assesses the effects on people, records the notification decision and manages any applicable deadline. Unknown facts remain clearly identified.
- Verification
Retain the decision and any notification evidence, test the corrective measure and update the incident record if later information changes the assessment.
Practical questions
What if the facts are incomplete?
Record what is known, what is uncertain and who is obtaining each missing fact. Make and update the risk assessment promptly. A developing investigation does not itself justify ignoring notification duties or deadlines.
What should the post-incident review add?
Identify the control failure and an action that addresses it, assign an owner and test the result. Preserve the original incident timeline and decisions so the later learning does not obscure what was known at the time.
Official sources
- ICO: Personal data breaches guide (opens in a new tab)
- UK GDPR Article 33 (opens in a new tab)
- UK GDPR Article 34 (opens in a new tab)
Source-linked editorial review: 1 November 2026. Guidance supports a documented process. It does not replace advice about your particular circumstances or verify your organisation’s compliance.
Content update — 2 November 2026: added an illustrative evidence record, practical questions and related guidance. The existing legal-source baseline is 1 November 2026.