Data security breach risk assessment template
- Art. 24 FADP
- Art. 33-34 GDPR
- About 20 minutes
- Italiano · Deutsch · Français · English
In brief
The worksheet by which you assess the risk a breach poses to the people affected and decide whether to notify it. It documents why you notified or did not.
- Who it is for
- Internal use: whoever handles the breach and management, who approve the decision.
- To decide first
- Nothing before use: for each incident you state the type of breach, the risk factors, severity and likelihood, and the decision on notification.
- Afterwards
- Fill one in for every incident, have it approved and keep it with the breach register.
What it contains
- 1Details of the case
- 2Type of breach
- 3Risk factors
- 4Severity of the consequences
- 5Likelihood
- 6Level of risk
- 7Decision on notification
- 8Measures still to be taken
- 9Approval
An excerpt
1. Details of the case
| Number in the breach register | __________ |
| Date and time at which the breach was discovered | __________ |
| Date or period in which it occurred | __________ |
| Assessment completed by | __________ |
| Persons consulted (management, IT) | __________ |
| Date of the assessment | __________ |
Brief description of the facts:
2. Type of breach
- ☐ Confidentiality: data disclosed or made accessible to unauthorised persons
- ☐ Integrity: data altered unintentionally
- ☐ Availability: data lost, destroyed or not accessible
The breach was: ☐ accidental ☐ intentional (unlawful act by third parties or by insiders) ☐ not known
3. Risk factors
For each factor, note the facts and state whether it increases or reduces the risk.
The full text is generated on the platform, with your organisation's details already in place.
Related templates
- Template for notifying data subjects of a data security breach
- Internal form template for reporting a data security breach
- Template for notifying a data security breach to the authority
Related question: Data security breach: when and how to notify the FDPIC?
A template is general information, not advice on your case: it must be adapted to your organisation. For a question on your case there is Advisorn's consulting. By Advisorn, updated on 20 October 2026.