EDPB Template for personal data breach notification

What it is about

At its June 2026 plenary the EDPB adopted a common data breach notification template (announced on 10 June 2026). The template is mainly meant for supervisory authorities to build into their IT systems. It asks for certain information only when needed, offers predefined values and recommended tooltips, and makes sure notifications contain the information Article 33 GDPR requires. The public consultation ran from 10 June to 5 August 2026 and is closed. After the consultation the EDPB will decide on the timeline for practical implementation by all supervisory authorities.

What this means in practice

You can already set up your internal breach register around the fields of the template, so a future notification to the Dutch DPA goes faster. Until implementation the current DPA notification form continues to apply. Watch the EDPB and the Dutch DPA for the implementation decision.

The GDPR articles concerned

• Article 33: Notification of a personal data breach to the supervisory authority
• Article 34: Communication of a personal data breach to the data subject