Data security breach procedure template (data breach)
- Art. 24 FADP
- Art. 33-34 GDPR
- About 15 minutes
- Italiano · Deutsch · Français · English
In brief
Sets who does what when data are lost, stolen, altered or seen by someone who should not have: from discovery to notification and the closing of the case. In an incident time is short: the procedure has to be decided beforehand.
- Who it is for
- Internal use: management, the internal contact, IT and whoever handles incidents.
- To decide first
- Whether you also process data on behalf of customers: if so, the procedure provides for informing them. The rest uses your organisation's details.
- Afterwards
- Make it known to all employees and prepare the breach report form and the breach register, which the procedure refers to.
What it contains
- 1Purpose and scope
- 2What a data security breach is
- 3Roles and responsibilities
- 4Step-by-step procedure
- 5Criteria for notification
- 6Suppliers and customers
- 7Timeline
- 8Documentation and retention
- 9Training and review
- 10Related documents
An excerpt
1. Purpose and scope
This procedure sets out how __________ recognises, handles, assesses, notifies and documents breaches of the security of personal data (commonly called a "data breach").
It applies to all employees and to third parties who process personal data on behalf of __________. It covers data on any medium: IT systems, mobile devices, cloud services, paper documents.
Legal bases:
- Art. 8 and 24 of the Federal Act on Data Protection (FADP) and Art. 15 of the Data Protection Ordinance;
- Art. 32, 33 and 34 of Regulation (EU) 2016/679 (GDPR).
2. What a data security breach is
It is a breach of security that, accidentally or unlawfully, leads to the loss, deletion, destruction or alteration of personal data, or to their disclosure or to access by unauthorised persons.
The full text is generated on the platform, with your organisation's details already in place.
Related templates
- Template for notifying data subjects of a data security breach
- Internal form template for reporting a data security breach
- Template for notifying a data security breach to the authority
Related question: Data security breach: when and how to notify the FDPIC?
A template is general information, not advice on your case: it must be adapted to your organisation. For a question on your case there is Advisorn's consulting. By Advisorn, updated on 20 October 2026.