Template for notifying a data security breach to the authority
- Art. 24 FADP
- Art. 33-34 GDPR
- About 30 minutes
- Italiano · Deutsch · Français · English
In brief
The template for notifying a data security breach to the data protection authority, with all the information the law requires. It keeps you from forgetting something when time is short.
- Who it is for
- The competent data protection authority. It remains an internal document until you send it.
- To decide first
- The facts of the incident: what happened and when, which data and how many people are affected, the likely consequences and the measures taken or planned.
- Afterwards
- Send the notification within the time laid down by law, keep the proof of dispatch and note everything in the breach register.
What it contains
- 1How to use this template
- 2Whom to notify and when
- 3Text of the notification
- 4After the notification
An excerpt
1. How to use this template
This template is used to prepare the notification once the risk assessment has established that it is required. It gathers the information the authority expects. The parts in square brackets are instructions to be replaced with the text of the specific case.
If not all the information is available, what is known is notified anyway, what is missing is indicated and it is communicated later. The end of the investigation is not awaited.
A copy of the notification and the authority's acknowledgement of receipt are kept with the breach register.
2. Whom to notify and when
Under the FADP (Switzerland)
- When: if the breach is likely to result in a high risk to the personality or fundamental rights of the data subjects (Art. 24 para. 1 FADP).
- By when: as soon as possible. The law does not set a number of hours.
- To whom: the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.
- How: the FDPIC provides an online notification form on its website (www.edoeb.admin.ch), which is the preferred channel. The text in chapter 3 serves to prepare the answers and may be used for a written notification.
- Content: that indicated in Art. 24 para. 2 FADP and Art. 15 para. 1 of the Data Protection Ordinance, reproduced in chapter 3. Missing information is provided as soon as possible (Art. 15 para. 2 of the Ordinance).
The full text is generated on the platform, with your organisation's details already in place.
FADP and GDPR compared
| FADP (Switzerland) | GDPR (EU) | |
|---|---|---|
| When | If the breach is likely to result in a high risk (Art. 24 para. 1 FADP) | Always, unless it is unlikely to result in a risk (Art. 33(1) GDPR) |
| By when | As soon as possible | Within 72 hours of becoming aware of it; after that, with the reasons for the delay |
| To whom | FDPIC, with the online form | The competent supervisory authority in the EU Member State |
The template adapts itself: it picks the paragraphs by the laws that apply to your organisation.
Related templates
- Template for notifying data subjects of a data security breach
- Internal form template for reporting a data security breach
- Data security breach procedure template (data breach)
Related question: Data security breach: when and how to notify the FDPIC?
A template is general information, not advice on your case: it must be adapted to your organisation. For a question on your case there is Advisorn's consulting. By Advisorn, updated on 20 October 2026.