Template A — Notification to the supervisory authority (Art. 33)

To: [Supervisory authority name / portal]
From: [COMPANY NAME], [address]
Data Protection Officer / contact: [NAME], [privacy@docs.example.com], [phone]
Date of this notification: [YYYY-MM-DD]
Breach reference: [BR-YYYY-NNN]

1. Nature of the breach
On [YYYY-MM-DD] at approximately [HH:MM], [COMPANY NAME] became aware of a
personal-data breach. [Describe what happened in factual terms — e.g. "a
misconfigured storage bucket exposed customer documents to the public internet
between [date] and [date]."]

This is a [confidentiality / integrity / availability] breach.

2. Categories and approximate number of data subjects affected
- Categories of data subjects: [e.g. customers / end users]
- Approximate number of individuals affected: [N] (estimate; subject to ongoing
investigation).

3. Categories and approximate number of records affected
- Categories of personal data: [e.g. names, email addresses, [special category
if any]]
- Approximate number of records: [N].

4. Likely consequences of the breach
[Describe the realistic risks to individuals — e.g. risk of phishing, identity
theft, distress. State if special category data was involved.]

5. Measures taken or proposed
- Containment: [e.g. secured the bucket, rotated keys, reviewed access logs].
- Investigation: [scope and status].
- Mitigation for individuals: [e.g. forced password reset, monitoring].
- Preventive measures: [e.g. infrastructure scanning, policy-as-code checks].

6. Has notification been delayed beyond 72 hours?
[No / Yes — if yes, give reasons for the delay as required by Art. 33(1).]

7. Will individuals be notified (Art. 34)?
[Yes — high risk / No — with justification (e.g. data was strongly encrypted and
keys not compromised).]

8. Further information
This notification is provided [in full / in phases]. [If phased: remaining
information will follow as the investigation progresses.]

Signed: [NAME, ROLE]

Included with GDPR Privacy Toolkit

Ready for the complete GDPR Privacy Toolkit?