Free checklistXLSX and ODS
Data Breach Response Kit
What to do when something goes wrong with personal data, in one file: the 72-hour plan, how to assess the risk, the authority notification and the notice to individuals, ready to adapt.
- A breach register with the columns Art. 33(5) asks for, and a summary that updates itself
- A 72-hour plan and a three-level way to classify the risk, following the EDPB
- Drafts of the authority notification and of the notice to the people affected, plus a card to pin up
- Reviewed
- 23 Oct 2026
- Legal basis
- GDPR Art. 33 and 34
- Size
- 56 KB (XLSX) · 56 KB (ODS)
What’s inside
Nine sheets, from the first alert to closing the incident.
Sheet 1StartHow to use the kit and where to begin when the alert comes in.
Sheet 2Breach registerOne row per incident, including the ones you do not have to report.
Sheet 3SummaryHow many incidents, of which type, and which ones were notified.
Sheet 472-hour planWhat to do in each phase: contain, assess, decide and notify.
Sheet 5How to assess riskThe criteria to decide between recording, notifying the authority and telling people.
Sheet 6Authority notificationThe Art. 33(3) elements, ready to fill in.
Sheet 7Notice to individualsA clear, plain-language message for the people affected.
Sheet 8Breach cardOne page to pin up: who to call and what to do in the first minutes.
Sheet 9ListsThe values behind the drop-down lists, which you can adjust.
Frequently asked questions
Do I have to give my email?
Yes. It helps us understand who uses the resources. We don’t ask for your name or company, and the newsletter only starts if you tick the box.
Can I use the kit with my clients?
You can use it in your organisation and in work for clients. You just can’t resell it as a product.
Does it replace legal advice?
No. The kit follows the GDPR and the guidance of the CNPD (Portugal’s data protection authority) and the EDPB, but each organisation has to confirm what applies to its own case.