A security team can contain an intrusion in an afternoon and still leave the organisation exposed for weeks because nobody worked out who had to be told, and by when. This free data breach response checklist is the notification, legal and communications workstream that starts when a breach of personal data is suspected or confirmed. The DPO, privacy lead or general counsel runs it alongside the technical response: the risk assessment, legal privilege, regulator notices under GDPR, UK GDPR, US state laws, HIPAA and SEC rules, card brand and contractual notices, letters and support for the people affected, and the breach register entry that closes it. Each regime appears only when the facts recorded at the start say it applies.
The Cybersecurity Incident Response Checklist is the technical playbook: triage the alert, contain the attacker, preserve evidence, eradicate and recover. It answers the question “is the threat gone?”. A personal data breach raises a different set of questions that the technical team is rarely equipped to answer. Whose data was it? Where do those people live? Are we the controller or a processor acting for a customer? Is the risk to them high enough that they must be told directly? Is the incident material to investors? Those answers decide which laws apply, and the laws decide the deadlines.
The two workstreams run at the same time and feed each other. Running them from one list tends to fail in one of two ways: the notification tasks wait until the investigation is “finished”, by which time the 72-hour GDPR window has gone, or the lawyers are pulled into containment calls and slow them down. A separate checklist with its own owner, linked to the incident record, lets each team move at its own pace.
Owner: the security lead or incident manager.
Starts: when a security event is declared an incident.
Output: a contained, eradicated and recovered environment, with evidence preserved.
Owner: the DPO, privacy lead or general counsel.
Starts: as soon as personal data may have been compromised, often before the investigation ends.
Output: documented notification decisions, notices sent, support for individuals and a breach register entry.
Owner: the DPO or compliance team.
Starts: on a schedule, usually annually.
Output: a tested breach procedure, current records of processing and processor contracts with notice clauses.
Start this checklist as soon as the incident record says personal data may be involved, including when the answer is “not yet known”. Ransomware cases usually arrive from the Ransomware Response Checklist once data theft is suspected, and compromised mailboxes from the Phishing Incident Response Checklist. Readiness, meaning a breach procedure, records of processing and processor contracts that would stand up to scrutiny, belongs in the annual GDPR Compliance Audit Checklist.
Seven phases take a personal data breach from the first suspicion to a closed register entry. The answers recorded in Phase 1 decide which notification tasks appear.
Owned by the DPO or privacy lead. Each yes/no answer in this phase switches on the matching notification tasks later.
Assigned to general counsel. Task 2 needs approval from counsel before any outside firm starts work.
The decision in task 5 needs approval from the DPO. A yes switches on Phase 6.
Assigned to the DPO and counsel. Tasks 1 to 3 appear only when Phase 1 records EU or UK residents, US residents or health data. Remove tasks 4 and 5 from your copy if you are not an SEC registrant, a financial institution or an NIS2 or DORA entity.
The card brand task appears only when Phase 1 records payment card data. The controller task appears only when Phase 1 records that you acted as a processor.
Appears only when Phase 3 records that individuals must be told. Letters need approval from counsel before they are sent.
Closure needs approval from the DPO and general counsel.
The table summarises the main deadlines as of October 2026. Which apply depends on your sector, location and customers, so confirm the list with counsel and treat it as a starting point, not legal advice.
| Regime | Who is told | Deadline | Phase |
|---|---|---|---|
| GDPR / UK GDPR Art. 33 | Supervisory authority (the ICO in the UK) | Without undue delay, where feasible within 72 hours of awareness, unless the breach is unlikely to result in a risk to individuals | Phase 4 |
| GDPR / UK GDPR Art. 33(2) | The controller, by its processor | Without undue delay after the processor becomes aware | Phase 5 |
| GDPR / UK GDPR Art. 34 | Affected individuals | Without undue delay where the breach is likely to result in a high risk to them | Phase 6 |
| HIPAA Breach Notification Rule | Individuals; HHS; media | Without unreasonable delay and no later than 60 calendar days from discovery; HHS within 60 days for 500 or more people, otherwise within 60 days of year end; media for 500 or more residents of a state | Phases 4 and 6 |
| US state breach laws | Residents; often the attorney general | Varies by state. 30 days in California (from 1 January 2026), Colorado, Florida, New York and Washington; the Texas attorney general within 30 days for 250 or more Texans | Phases 4 and 6 |
| SEC Form 8-K Item 1.05 | Investors | Four business days after determining the incident is material | Phase 4 |
| SEC Regulation S-P | Affected individuals | No later than 30 days after becoming aware; service providers tell the covered institution within 72 hours | Phases 4 and 6 |
| FTC Safeguards Rule | The FTC | As soon as possible and no later than 30 days after discovery, for unencrypted data of 500 or more consumers | Phase 4 |
| NIS2 Art. 23 / DORA | CSIRT or competent authority | NIS2: 24-hour early warning, 72-hour notification, final report in one month. DORA: initial report within 4 hours of classifying an incident as major and no later than 24 hours from awareness | Phase 4 |
| Visa rules | Visa and your acquirer | Within three calendar days of reasonable suspicion of a compromise of Visa account data | Phase 5 |
All 50 US states and the District of Columbia have breach notification laws; Alabama was the last state to pass one, in 2018. Many still require notice “without unreasonable delay” rather than within a fixed number of days, but the trend is towards hard deadlines: California’s SB 446 set 30 calendar days from 1 January 2026, plus a sample notice to the attorney general within 15 days where more than 500 Californians are affected. Regulation S-P’s amendments applied to larger entities from 3 December 2025 and smaller ones from 3 June 2026. Under HIPAA, a business associate must tell the covered entity within 60 days of discovery, and the covered entity then owns the notices.
NIS2 and DORA reports cover significant or major incidents whether or not personal data is involved, so in-scope entities may already be filing them from the incident response checklist; cross-reference them here so regulators receive one consistent account. The EDPB’s Guidelines 9/2022 confirm that a controller outside the EU with no EU establishment must notify every authority where affected people live.
Phase 1 records where the affected people live, your role and whether health, card or financial data is involved. Conditional logic shows the matching notification tasks and hides the rest, so a UK-only staff breach does not carry twenty US tasks.
Each notification task has a required yes/no answer and a text field for the reasoning, so a decision not to tell a regulator is as visible in the audit trail as a decision to tell one, with a name and a time.
Letters, regulator submissions and the risk rating are approval steps assigned to counsel or the DPO by name. The checklist halts until they approve, so a well-meaning manager cannot send a customer email that contradicts the regulator notice.
CheckFlow is not a legal research tool or a breach notification service. It runs the human side of the response: who decides, who drafts, who approves and what was sent, with each step timestamped. For the recurring privacy and security reviews around it, CheckFlow’s compliance checklist software keeps owners, evidence and approvals in one place.
A breach response is only as quick as the facts behind it. The GDPR Compliance Audit Checklist confirms you know what personal data you hold and where, the Vendor Risk Assessment Checklist checks that suppliers will tell you promptly about their breaches, and the Incident Response Tabletop Exercise Checklist lets you rehearse the 72-hour decision before it is real. Healthcare teams can read our HIPAA compliance checklist guide for the wider Security Rule programme.
It should record when you became aware of the breach, what personal data and which people are affected, and where they live. It then needs a documented assessment of the risk to those people, a decision for each regulator and each group of individuals on whether to notify, the notices themselves, support such as a helpline or credit monitoring, and a breach register entry. Containing the attacker belongs in a separate incident response checklist running alongside it.
No. Under GDPR and UK GDPR you must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals. A report that arrives after 72 hours must explain the delay. Breaches you decide not to report still have to be documented under Article 33(5), with the facts, the effects and what you did about them, so the regulator can check your reasoning later.
It depends on which law applies. Every state has its own breach notification law; some set a fixed limit, such as 30 days in California, Colorado, Florida, New York and Washington, while others require notice without unreasonable delay. The HIPAA Breach Notification Rule allows no more than 60 calendar days from discovery, and the SEC’s Regulation S-P allows no more than 30 days for covered financial firms. Where several apply, the shortest deadline drives the plan. Confirm the position with counsel, as state laws change often.
Sometimes. A few US states require it when Social Security numbers are involved; Connecticut, for example, requires at least 24 months of identity theft prevention and mitigation services at no cost. Elsewhere it is usually optional but commonly offered where government ID or financial data was taken. Record the decision and the reasons either way.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
