Data security breach register template
- Art. 24 FADP
- Art. 33-34 GDPR
- About 10 minutes
- Italiano · Deutsch · Français · English
In brief
The register in which you note every data security breach, including those you do not notify: facts, consequences, measures and decisions. It shows how you handled each incident.
- Who it is for
- Internal use: it is kept by whoever handles breaches. It is shown to the authority on request.
- To decide first
- Nothing before use: you prepare the empty register and add a row for each incident.
- Afterwards
- Keep it where whoever handles incidents can find it at once and update it for every case, even a minor one.
What it contains
- 1Purpose
- 2How to keep the register
- 3Explanation of the columns
- 4Register
- 5Review
An excerpt
1. Purpose
In this register __________ documents all breaches of the security of personal data, including those that have not been notified to the authority. The register makes it possible to demonstrate that every case has been assessed and handled, and to recognise recurring incidents.
Under Art. 15 para. 4 of the Data Protection Ordinance, the controller documents breaches: the documentation contains the facts, the effects and the measures taken and must be kept for at least two years from the date of the notification to the FDPIC.
Under Art. 33(5) GDPR, the controller documents any personal data breach, including its circumstances, its effects and the remedial action taken. The documentation enables the supervisory authority to verify compliance with the obligations.
The full text is generated on the platform, with your organisation's details already in place.
FADP and GDPR compared
| FADP (Switzerland) | GDPR (EU) | |
|---|---|---|
| What | Facts, effects and measures taken (Art. 15 para. 4 Data Protection Ordinance) | Facts, effects and remedial action taken (Art. 33(5) GDPR) |
| For how long | At least two years from the notification | No fixed period |
The template adapts itself: it picks the paragraphs by the laws that apply to your organisation.
Related templates
- Template for notifying data subjects of a data security breach
- Internal form template for reporting a data security breach
- Template for notifying a data security breach to the authority
Related question: Data security breach: when and how to notify the FDPIC?
A template is general information, not advice on your case: it must be adapted to your organisation. For a question on your case there is Advisorn's consulting. By Advisorn, updated on 20 October 2026.