Privacy & Cybersecurity Law Blog

On June 10, 2026, the European Data Protection Board (“EDPB”)  opened a public consultation on a new template for personal data breach notifications. According to the EDPB, the template is intended primarily for use by data protection authorities (“DPAs”) through an IT tool rather than a simple standalone form.

The proposed template is detailed, containing approximately 126 questions designed to help standardize the information organizations provide when notifying a breach. Like many breach notification forms used by DPAs, the template covers core factual information, including the type of notification, the identity of the controller and reporting person, the timing and discovery of the breach, the nature and cause of the incident, the categories and volume of affected data and individuals, and the safeguards in place when the incident occurred. It also requires organizations to evaluate the likely consequences for affected individuals, assess the risk to individuals’ rights and freedoms, and describe both the measures taken to address the breach and any longer-term steps intended to prevent a recurrence. The template further includes a dedicated section on whether affected individuals have been notified, along with questions on notifications to other authorities or bodies, cross-border processing, processing involving non-EEA establishments, and the opportunity to include any supporting attachments.

A notable feature of the template is its use of conditional logic, predefined response options and explanatory tooltips, which appear intended to collect information only where relevant and to make the form easier for organizations to complete.  

The EDPB has invited stakeholders to submit comments by August 5, 2026. According to the EDPB, comments submitted will be published on the EDPB website.

Review the template form here. Read the press release here.