EU GDPR Personal Data Breach Response Management System
EU GDPR Personal Data Breach Response Management System
An editable system for responding to personal data breaches under the GDPR, from the first report through notification decisions to root cause and review.
Couldn't load pickup availability
Written and reviewed by practising specialists. Who writes this
Built and reviewed with our methodology. Read it
By document type
| Category | Files |
|---|---|
| Policies | 3 |
| Procedures & SOPs | 18 |
| Plans & Programmes | 20 |
| Forms & Records | 86 |
| Checklists & Audit Tools | 75 |
| Registers, Logs & Matrices | 60 |
| Job Descriptions & Organisation | 2 |
| Training & Awareness | 21 |
| Guides & Work Instructions | 13 |
| Tools & Workbooks | 10 |
| Other Documents | 23 |
Key documents
| Reference | Document | Format |
|---|---|---|
| AGS-PDBR-02 | Personal Data Breach Response Policy | Word |
| AGS-PDBR-02 | Integrated Security Incident and Personal Data Breach Procedure | Word |
| AGS-PDBR-05 | Personal Data Breach Risk Assessment Methodology | Word |
| AGS-PDBR-06 | Supervisory Authority Notification Procedure | Word |
| AGS-PDBR-06 | Initial Notification Form | Word |
| AGS-PDBR-10 | Article 33(5) Personal Data Breach Register | Excel |
- Need the complete document list? Request it — same day
- Want to check the quality first? Preview free samples
Overview
When a breach is discovered, the clock starts. Someone has to decide quickly whether the supervisory authority must be told, whether individuals must be told, and what evidence supports each decision. This system sets out that path in advance, with a first-24-hour and first-72-hour route through it.
It follows a breach lifecycle from detection to review. Intake forms are organised by incident type. A risk assessment method keeps the Article 33 threshold for notifying the authority separate from the Article 34 threshold for telling individuals, with likelihood and severity criteria and harm-specific assessments. A generic notification template covers the content the authority must receive, with phased notification where facts are still emerging. No supervisory authority's form or portal is reproduced, and you verify the national procedure that applies to you.
The system rests on Regulation (EU) 2016/679 (GDPR), Article 4, Article 33 and Article 34, with European Data Protection Board guidelines on breach notification and on examples of breach notification cited as guidance. AGS is independent and is not affiliated with the European Data Protection Board or any supervisory authority. Regulations are referenced by citation.
What this system covers
- Governance and preparedness: a breach response policy, an integrated security incident and breach procedure, team terms of reference, escalation and notification authority matrices, and interfaces with legal counsel and forensic providers.
- Detection and triage: intake by incident type, triage and containment.
- Risk assessment: the Article 33 and Article 34 method with harm-specific assessment forms.
- Notification: a 72-hour record, phased notification and a generic supervisory authority template.
- Communication: letters, alerts, an FAQ and a call-centre script for affected individuals, processor communication and crisis communication.
- Records and recovery: the breach register required by the GDPR, evidence registers, root cause, corrective action and recovery.
- Readiness: exercise scenarios, a staff awareness guide, training, audit tools, matrices and worked cases with mixed outcomes, including breaches that were not notified.
Who it's for
Controllers, joint controllers and processors handling personal data in any format and location. The DPO, a Breach Response Lead and the senior managers who take notification decisions each have defined roles.
Organisations running an ISO/IEC 27001 ISMS can use it alongside the ISMS - ISO/IEC 27001:2022 toolkit, which covers incident management, as this system adds the GDPR breach decisions. Standards are referenced by number and title only, and no standard text is included.
Everything you get
Every toolkit gives you a full set of working documents for your standard, ready to edit and use.
Native Microsoft files. Add your logo and adapt every document to how you work.
Your full toolkit arrives as a ZIP the moment payment clears.
One purchase covers everyone in your organisation. No per-seat fees.
Built by people who run real audits, so the content matches what assessors check.
One payment, perpetual licence for your organisation. No subscriptions, no renewals.
Full refund if your files are faulty, incomplete or not as described and we can't put it right
Frequently asked questions
What exactly do I receive?
A downloadable ZIP containing the full set of ready-to-use documents for this toolkit — manuals, procedures, forms, records, checklists, guidance and training material, all in editable Word and Excel format. The exact document count is shown at the top of this page.
Are the documents really editable?
Yes. Every file is native Microsoft Word or Excel — no locked PDFs. Add your logo, change wording, and tailor the content to your organisation. The toolkit is yours to keep and reuse.
Does this certify my organisation?
No. These are documentation toolkits aligned to the relevant standard to help you prepare. Certification itself is issued by an accredited certification body after their audit. Our toolkits give you a strong, audit-ready starting point.
How is it delivered?
Instantly and digitally. There's no physical shipment — you download the files right after payment and receive a backup link by email.
Do I get updates?
Yes. If we revise this toolkit, you're entitled to the updated version at no extra cost — just contact us with your order details.
What is your refund policy?
These are digital products, so once a toolkit has been downloaded we cannot take it back. If you have not downloaded yet, contact us and we will cancel the order and refund you in full. We also refund in full if the files are damaged, incomplete, or not what the product page described.
Cannot find your standard?
Tell us which scheme you work to. We will point you to the right toolkit.
More in EU Compliance
See all 15
DORA ICT Third-Party Risk & Digital Operational Resilience Management System
EU Compliance265 documents $2,450USD
NIS 2 Management Body & Cybersecurity Awareness Training Package
EU Compliance360 documents $550USD
NIS 2 & ISO/IEC 27001:2022 Integrated Management System
EU Compliance368 documents $950USD