Data Breach Record

This record is one step in a larger programme. Using it for work that belongs to a neighbouring template produces records that are hard to report on later.

ISO 27701 places breach response inside the same incident management discipline as any security incident, while GDPR attaches a short clock to the outcome. The record has to satisfy both: the requirement to respond and learn, and the statutory duty to notify within a fixed window where the threshold is met.

The duty to assess harm is close to universal. What differs sharply between regimes is whether a notification clock exists at all, how short it is, and who bears the burden of showing the threshold was not met.

The template captures discovery, containment, assessment and notification as separate sections. What decides whether the record is defensible afterwards is judgement the fields alone do not enforce.

The findings below concern whether the record shows a reasoned sequence from discovery to notification, or fields completed after the fact to match a decision already made.

A payroll error sent a spreadsheet with salary and bank details to the wrong internal list. The sender recalled it within the hour and confirmed with IT that no recipient appeared to have opened it. Breach Contained and Further Loss Prevented were both recorded Yes the same day, and the incident looked closed within 24 hours.

The assessment took three weeks: nobody had confirmed the recall succeeded on every device, some running mobile clients that do not honour recalls, and the privacy lead would not sign off Likelihood Of Harm Assessed without that check. Once two recipients were confirmed to have opened it first, the 72-hour window had long passed. The delay was a careful assessment outrunning the clock, not concealment, and the record had to show that, because an unexplained late notification reads identically to one simply forgotten.

The form captures the assessment. What determines whether a breach is caught, assessed and notified on time is whether the surrounding process notices the incident happened at all.

KnowComply

Holds the breach register against the processing register, starts the notification clock the moment a breach is opened, and flags a close deadline.

KnowHealth

Surfaces occupational health data as a distinct, higher-sensitivity category the moment a breach record marks health data involved.

KnowContractor

Extends the breach process to third-party systems, where a loss often happens outside the IT estate and is reported late as a result.

Ella

Watches Discovered and Status for a breach approaching the deadline, and raises it before the clock, not after.

Personal data breach

A breach of security leading to accidental or unlawful destruction, loss, alteration, disclosure of, or access to personal data: confidentiality, integrity and availability, not only access.

Special category data

Data revealing health, biometric or genetic status, ethnic origin, or religious belief, raising the bar for what counts as a notifiable risk.

Notification threshold

The assessed likelihood a breach risks individuals' rights and freedoms, which determines whether notification is required, not the fact of the breach alone.

Undue delay

The standard most clocks use instead of a fixed point: notification as soon as reasonably possible, with 72 hours the outer limit, not the target.

Containment

The immediate action to stop a breach worsening, such as recovering a device or securing a system, distinct from later harm assessment.