.png?width=1425&height=1425&name=Icons%20(20).png "Icons (20)")
Free Download | Data Breach Policy Template
So the first breach isn't also the first time you've thought about this...
Most data breaches don't look like a hacker in a hoodie...
They look like an email sent to the wrong person, a laptop left on a train, or a document shared with the wrong permissions 😬
What actually determines the damage isn't the breach itself, it's what happens in the hours afterwards. Who gets told, how fast, and whether anyone actually knows the ICO's 72-hour clock has already started ⏱️
This template is that process, written down in advance, so nobody's figuring it out for the first time under pressure.
Free to download and easy to make your own.
Download your free Data Breach policy template!
What's in this template?
Short on time? Here's what's in this guide:
- What's inside the data breach policy template
- Why bother with a breach policy before you need one
- Who this template is built for
- How to use it
- Where breach response usually goes wrong
- Frequently asked questions
📄 What's inside the data breach policy template
It's built around the actual sequence of a breach: spot it, contain it, assess it, report it, and learn from it.
| Section | What it covers |
|---|---|
| What counts as a breach | Real examples, from a misdirected email to an unsecured supplier tool, not just the dramatic ones |
| How to report one internally | Who to tell, how fast, and why "I wasn't sure if it counted" isn't a reason to wait |
| Investigation and risk assessment | Appointing a lead investigator and working out how serious it actually is |
| Notifying the ICO | When the 72-hour clock applies, who decides, and what has to be included |
| Notifying affected individuals | When the bar for telling people directly is met, and what they need to hear |
| Other parties | When a data controller, supplier, or law enforcement also needs telling |
| Breach review and records | Logging every breach, notifiable or not, and closing the loop so it doesn't happen twice |
| Definitions | Plain-English definitions for personal data, special category data, processing, and more |
Why bother with a breach policy before you need one
Nobody plans to have a data breach. That's rather the point.
When one happens, the business has 72 hours to decide whether it's notifiable to the ICO, and potentially far less time than that to stop it getting worse. Figuring out who's responsible for what, on the day, while also containing the actual problem, is how a manageable incident turns into a genuinely bad one.
A breach policy fixes the order of operations in advance: who gets told first, who investigates, how risk gets assessed, and who makes the call on notification. It also gives you something to show afterwards, to the ICO, to an auditor, or to an investor doing due diligence, that this wasn't handled on the fly.
Want a second opinion on how prepared your business actually is? Trust Keith runs free monthly Office Hours where you can ask a privacy expert directly.
Who this data breach policy template is built for
This one's for scaleups, not enterprises. It's a good fit if your business:
- Has roughly 50 to 250 employees
- Processes personal data at scale, or handles special category data (health, biometric, financial)
- Doesn't have a dedicated incident response team to fall back on
- Needs to prove compliance to investors, enterprise customers or regulators, without a full in-house legal or privacy team
Trust Keith works with data-centric scaleups across fintech, healthtech, HR tech and ed tech, exactly the businesses where a breach can't be handled by whoever happens to notice it first.
How to use this data breach policy template
Step One: Make a copy and swap in your company name. Find and replace every instance of {Company Name} throughout the document.
Step Two: Name your Primary Security Contact. One person needs to be the first call when something goes wrong, and everyone needs to know who that is before it happens.
Step Three: Set up your breach log. Every breach gets recorded, whether it's reportable or not, so you can show a pattern of good practice, not just react to the big ones. A risk register makes this easier to keep on top of.
Step Four: Train your team to actually recognise one. Most breaches are spotted by ordinary staff, not security tools. Training that covers real examples, not just the legal definition, is what gets things reported early instead of quietly ignored.
Step Five: Get it reviewed. Have a privacy expert check it's proportionate and accurate before you rely on it. Trust Keith customers get expert-tailored, audit-ready policies as standard; going it alone just means budgeting time for a proper review.
Where breach response usually goes wrong
Nobody reports the small stuff. Most breaches aren't dramatic. If staff only think "breach" means a hack, misdirected emails and lost devices go unreported for weeks.
No single owner. When a breach happens and three different people think someone else is handling it, the 72-hour clock keeps running regardless.
Treating every breach as notifiable, or none of them. Both are wrong. The decision needs an actual risk assessment, not a guess made under pressure.
No record of the ones that didn't get reported. The ICO expects evidence of every breach, not just the ones that crossed the notification threshold.
No review afterwards. If the same type of breach keeps happening, that's a training or process gap, not bad luck.
Frequently asked questions
What counts as a personal data breach?
Any accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of, or access to, personal data. That covers obvious things like a stolen laptop, but also an email sent to the wrong person, an unattended screen, or a supplier tool that isn't secure.
How long do you have to report a data breach?
If a breach is likely to result in a risk to individuals' rights and freedoms, it must be reported to the ICO without undue delay, and within 72 hours of becoming aware of it wherever possible. If it's high risk to those individuals, they need to be told too.
Do all data breaches need to be reported to the ICO?
No. Only breaches likely to result in a risk to people's rights and freedoms are notifiable to the ICO. But every breach, notifiable or not, should still be logged internally as part of your accountability obligations.
Is this data breach policy template really free?
Yes. Trust Keith built this to help data-centric scaleups get a proper breach response process in place quickly. It's free in exchange for a work email, and it's yours to edit, use and share internally.
What should a data breach policy include?
Who's covered, what counts as a breach, how to report one internally, who investigates it, how risk is assessed, when the ICO and affected individuals need notifying, and how breaches get logged and reviewed afterwards. Trust Keith's free template covers all of it.
Does this template replace legal advice?
No. It's a strong starting point, but it should be reviewed by a privacy expert before being relied on, especially for businesses handling special category data or operating across multiple jurisdictions.
Curious how Trust Keith can help take breach response off your plate?
A template gets the process written down. But when an actual breach happens, having someone who's handled one before matters just as much as having the right document.
Trust Keith gives you a dedicated privacy expert, embedded in your business, backed by an intelligent platform that keeps your incident records audit-ready before, during and after a breach.
Disclaimer: This template is provided free of charge for general information purposes only. It does not constitute legal advice and should not be relied upon as such.
.avif "Trust Keith Platform")
Everything you need to run privacy properly in any jurisdiction
Trust Keith holds your hand to get you (and keep you!) as compliant as you need by giving you access to a dedicated human expert and an intelligent platform.
