EDPB Adopts Common Data Breach Notification Template

Jun 29 2026

One of the more practically significant outcomes of the European Data Protection Board (EDPB)’s June 2026 plenary session, was the adoption of a common template for personal data breach notifications under the GDPR.

The initiative is part of the EDPB’s Helsinki Statement on enhanced clarity, support and engagement, which aims to simplify GDPR compliance and strengthen consistency across EU Member States.

The new common template is designed to help organizations and Data Protection Authorities (DPAs) structure, harmonize and unify their data breach notification processes across Europe.

Under Article 33 GDPR, controllers are required to notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours. In practice, however, notification requirements and formats have varied across Member States, creating operational complexity particularly for organisations active in multiple EU jurisdictions.

The new template seeks to address this fragmentation by providing a standardised structure for breach notifications across the EU. It includes predefined values and recommended tools for organisations to facilitate their completion of the form.

The template is currently subject to a public consultation which is open until 5 August 2026. Stakeholders are invited to submit comments on the content of the template. Following the consultation, the EDPB will determine the timeline for implementation by all DPAs within the European Union.

In addition to the data breach template, the plenary discussions featured the European Commission’s Digital Omnibus proposal. While the EDPB welcomed several proposed changes within the Omnibus package, the Board reiterated its opposition to the proposed amendments regarding the definition of personal data. The EDPB has expressed concerns that narrowing the scope of what constitutes personal data risks significantly weakening individual data protection rights.