Free register template

Data breach register

A data breach register records every suspected or confirmed breach of personal information, even the small ones: what happened, whose data was affected, how serious the risk is, when it was contained and who was told. Many privacy laws expect you to keep one, and it shows which mistakes keep happening.

Updated November 2026 · PDF, Word and CSV · Free to use, don’t resell

Download PDF Use it in Wikidoc ↓

Check this template against your local regulations and your own policies before you use it.

Business
Kept by
Last reviewed

One row per data breach. Handled by: the person responsible for it.
Status: Reported, Contained, Assessing or Closed.
Risk of harm: Low, Medium or High.
In Wikidoc, whoever is in Handled by is reminded on their Home page before Action due (7 days ahead).

Breach summary	Date found	Data and people affected	Risk of harm	Contained on	Must be reported to a regulator	Notified (who and when)	Handled by	Status

Common questions

What is a data breach register?

A record of every time personal information was lost, sent to the wrong person, accessed without permission or exposed, with what was done about it. It's also called a breach log or privacy incident register.

Do I need to record breaches that weren't reported?

Many privacy laws, such as the UK and EU GDPR, expect you to record every breach, including ones you decided not to report, with the reason. Even where it isn't required, the record shows patterns and supports your decision later.

How quickly must a data breach be reported?

It depends on the law. The UK and EU GDPR give 72 hours to tell the regulator about a reportable breach, Australia's scheme gives up to 30 days to assess one, and US state laws vary. Check the rule that applies to you.

Will a breach register make my business compliant with privacy law?

No. It's one record a privacy law may expect, not proof that you meet the law. What you must record and report depends on your country, state and industry, so check with your privacy regulator or an adviser.

Who can see the data breach register in Wikidoc?

Get started opens a Data breaches register that's private by default, so only the people you choose can see it. It's on the Team plan, and the person handling each breach is reminded on their Home page 7 days before an action is due.

Data breach register

How to use this template

Use it in Wikidoc

Open it in Wikidoc

Make the fields yours

Get reminded on Home

Related templates

Data breach response procedure

Data breach response flowchart template

Incident register template

Privacy breach response procedure

30-60-90 day plan template

Annual compliance review checklist

Common questions

What is a data breach register?

Do I need to record breaches that weren't reported?

How quickly must a data breach be reported?

Will a breach register make my business compliant with privacy law?

Who can see the data breach register in Wikidoc?

Run your checklists and SOPs in one place