The European Data Protection Board (EDPB) has recently published a draft template for personal data breach notification, which if approved, is intended for use by supervisory authorities across the EU.

Current process

Unless controllers with multiple EU establishments fall within the thresholds of the 'one stop shop' regime, (which permits reporting to a single lead supervisory authority), the administrative burden of data breach reporting has been significant under the current regime due to different supervisory authority reporting forms. While the underlying framework for reporting to supervisory authorities will not change, the introduction of a single form reporting template will lessen the administrative burden on data controllers who are required to notify across multiple member states.

The new template seeks to address this by integrating the notification into a single, standardised form, facilitating GDPR compliance across all relevant supervisory authorities. Whilst a separate form will still need to be submitted to each supervisory authority, the information required will be the same.

Proposed changes

At present, the process for breach notification is governed by multiple instruments, namely:

1. Article 33 GDPR, which sets out baseline information requirements and the 72-hour notification window;
2. WP29 Guidelines (Personal Data Breach Notification);
3. EDPB Guidelines 01/2021 (Examples Regarding Data Breach Notification); and
4. GDPR Articles 33 and 34 more broadly.

The new form is structured so as to address relevant data breach requirements, providing a clear and systematic framework for controllers to follow when completing their notification. 

Incomplete notifications

A further practical benefit of the new form is the ability to submit incomplete notifications. This means that users can submit information whilst still concluding their investigations, then supplement their notification as further details come to light. This pragmatic approach acknowledges the reality that a complete picture is rarely available within 72 hours.

Timelines 

The draft is currently open for public feedback, with responses due by 5 August 2026 and the timeline for implementation to be confirmed. Any feedback received will be published on the EDPB website.

How to prepare

Although the EDPB template remains in draft form, now is a good time for organisations to begin considering how the new form may affect their breach notification processes. In particular, organisations should review their existing procedures and assess what changes may be needed to align with the standardised format once it is finalised. Taking a proactive approach at this stage will help to ensure a smoother transition when the template is formally adopted.

If you have any questions about what the new template means for your organisation, or would like help reviewing your breach notification procedures, please do get in touch. Our specialist data protection team advises organisations across a wide range of sectors on all aspects of data protection compliance, including breach preparedness, incident response and regulatory engagement.