Data Breach Notification Policy
Updated 7 February 2026
This template sets out the organisation’s process for identifying, managing, recording, and reporting personal data breaches in compliance with the UK GDPR and the Data Protection Act 2018. It explains staff responsibilities, internal escalation, and when and how breaches must be notified to the ICO and affected individuals.
Data Breach Notification Policy
Purpose and Scope
This policy sets out [company name]’s approach to identifying, managing, recording, reporting and responding to personal data breaches in accordance with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.
It applies to all employees, directors, contractors, agents, advisers, and other third parties acting on behalf of [company name] who process or have access to personal data held by the organisation.
Definitions
Personal Data: Any information relating to an identifiable individual.
Personal Data Breach: A breach of security which leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. This includes, but is not limited to, loss of data or devices, system hacks, unauthorised access, disclosure to incorrect recipients, or the accidental publication of personal data.
Responsibilities
Data Protection Officer (DPO) or other designated data protection lead: Oversees breach management, reporting to the ICO and affected individuals as required. [company name]'s DPO can be contacted at [insert dpo or data protection contact details].
Employees and Contractors: Must report all actual or suspected data breaches to the DPO immediately.
If applicable:
Breach Management Team: Provides support to assess and contain breaches.
Reporting a Breach
Internal Reporting
All individuals must report any actual or potential data breach to the DPO without undue delay, and no later than 24 hours after becoming aware of it, regardless of perceived severity.
Third-Party Reporting
Processors acting on behalf of the organisation are required to notify the organisation without undue delay after becoming aware of a personal data breach. If a third party (such as a processor) notifies us of a breach affecting the organisation’s personal data, we will treat this as an internal report and follow the same procedure.
Assessment and Investigation
Upon notification, the DPO (or designated lead) will:
Confirm whether a personal data breach has occurred.
Assess the nature, scope and likely impact of the breach.
Contain and recover personal data, where possible.
Determine whether the breach is notifiable to the Information Commissioner’s Office (“ICO”) and/or affected individuals.
This assessment will include consideration of the likelihood of harm to individuals’ rights and freedoms. Serious or high-risk breaches may be escalated to senior management and, where appropriate, the board of directors.
Notification to the Information Commissioner’s Office
A breach that is likely to result in a risk to individuals’ rights and freedoms must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. If the organisation cannot provide all required information within 72 hours, it will submit what it can and provide the remainder as soon as possible.
Note: For the purposes of this policy, the organisation is considered “aware” of a personal data breach when it has a reasonable degree of certainty that a security incident has occurred that has led to personal data being compromised.
Notification to the ICO will include:
A description of the nature of the breach, including categories and approximate numbers of individuals and records affected.
Contact details of the DPO or other contact point.
A description of the likely consequences.
A description of the measures taken, or proposed to be taken, to address and mitigate the breach.
Notification to Affected Individuals
Where the personal data breach is assessed to be likely to result in a high risk to the rights and freedoms of individuals, [company name] will notify affected individuals without undue delay. The communication will be written in clear and plain language and include:
The nature of the breach.
Contact details of the DPO or representative.
The likely consequences of the breach.
Measures taken or proposed to mitigate adverse effects.
Notification to affected individuals will not be required where appropriate technical and organisational measures (such as encryption) were in place, or where subsequent measures ensure the high risk is no longer likely to materialise, in accordance with Article 34 UK GDPR.
Record Keeping
All personal data breaches, regardless of whether they require notification to the ICO or individuals, will be recorded in the Data Breach Register, including:
Facts relating to the breach.
Effects of the breach.
Remedial actions taken.
This record will support future review, accountability and compliance audits.
Training and Awareness
[company name] will provide appropriate training on data protection and breach procedures to relevant personnel. Awareness activities will be undertaken periodically to reinforce obligations under this policy.
Review
This policy will be reviewed at least annually or following a significant breach, regulatory change, or organisational change affecting personal data processing.
Policy approved by: ____________________
Date: ____________________
Next Review Due: ____________________
About this template
What is this template?
Data Breach Notification Policy is a free, ready-to-use Data Protection & Privacy template you can open, customize, and download on GitLaw. It gives you a professionally structured starting point, so you never have to draft from a blank page. The wording is plain and modern, organized into clear sections that are easy to read, edit, and adapt to your own situation before you share or sign it.
When should you use it?
Reach for this Data Protection & Privacy template whenever you need a reliable agreement quickly and want to be sure the essentials are covered. It suits individuals, freelancers, startups, and established businesses alike. Instead of paying for a document drafted from scratch, you can start here, tailor the details to your arrangement, and have a polished draft ready in minutes. This version is drafted with England & Wales in mind, though you should always review the final wording against the laws that apply to you.
What's typically included?
A well-drafted Data Protection & Privacy usually sets out the parties involved, the scope of the agreement, and each side's rights and responsibilities. Expect sections covering key terms and definitions, how long the agreement lasts, how it can be ended, and what happens if something goes wrong. This template brings those building blocks together in a sensible order, so you can focus on the specifics rather than worrying about what to include. Open it to read the full document, then sign up to edit, negotiate, and e-sign it directly in GitLaw.