Template for notifying data subjects of a data security breach
- Art. 24 FADP
- Art. 33-34 GDPR
- About 20 minutes
- Italiano · Deutsch · Français · English
In brief
The letter that tells the people whose data were affected by a breach what happened, in plain words. You need it when the incident puts them at risk or when the authority asks for it.
- Who it is for
- The people affected by the incident. You send it by post or e-mail, after removing the instructions for use.
- To decide first
- What happened and when, which data are involved, what the possible consequences are, what you have already done and what you advise people to do.
- Afterwards
- Send it without delay, keep a copy and note the dispatch in the breach register.
What it contains
- 1Guidance for use (to be removed before sending)
- 2Text of the communication
An excerpt
Guidance for use (to be removed before sending)
- When to send it. Under the FADP, the persons concerned must be informed when this is necessary for their protection or when the FDPIC so requires (Art. 24 para. 4 FADP). Under the GDPR, data subjects must be informed without undue delay when the breach is likely to result in a high risk to their rights and freedoms (Art. 34 GDPR). Even where it is not mandatory, the communication is recommended whenever the persons concerned can do something to protect themselves.
- Minimum content. FADP: nature of the breach, consequences and risks, measures taken or planned, contact person (Art. 15 para. 3 of the Data Protection Ordinance). GDPR: nature of the breach, contact point, likely consequences, measures taken or proposed (Art. 34(2) GDPR). The text below covers all of these points.
- Language. Short sentences, no technical or legal terms, no playing down. The parts in square brackets must be replaced with the text for the specific case.
- Channel. Use a direct and personal channel (letter, e-mail, telephone), separate from advertising messages. If individual communication is impossible or would involve disproportionate effort, inform by means of a public communication that is equally effective, for example a clearly visible notice on the website.
- Security. Never ask for passwords or bank details in the communication and do not include links to login pages: the recipient must be able to tell the message apart from an attempted scam.
- Documentation. Record the date, channel and recipients of the communication in the breach register.
The full text is generated on the platform, with your organisation's details already in place.
FADP and GDPR compared
| FADP (Switzerland) | GDPR (EU) | |
|---|---|---|
| When to inform | If it is necessary for their protection or the FDPIC requests it (Art. 24 para. 4 FADP) | If the breach is likely to result in a high risk to their rights and freedoms (Art. 34 GDPR) |
| By when | As soon as possible | Without undue delay |
| Exceptions | Overriding interests of third parties, a statutory duty of confidentiality, informing is impossible or disproportionate (Art. 24 para. 5 FADP) | Data rendered unintelligible, risk eliminated, disproportionate effort: then a public communication (Art. 34(3) GDPR) |
The template adapts itself: it picks the paragraphs by the laws that apply to your organisation.
Related templates
- Internal form template for reporting a data security breach
- Template for notifying a data security breach to the authority
- Data security breach procedure template (data breach)
Related question: Data security breach: when and how to notify the FDPIC?
A template is general information, not advice on your case: it must be adapted to your organisation. For a question on your case there is Advisorn's consulting. By Advisorn, updated on 20 October 2026.