The European Data Protection Board has adopted a common template for personal data breach notifications under the GDPR following its June 2026 plenary session.
The move forms part of the EDPB’s Helsinki Statement on enhanced clarity, support and engagement, which aims to simplify GDPR compliance across EU Member States.
The new template is designed to help organisations and Data Protection Authorities structure, harmonise and unify their data breach notification processes throughout Europe.
Under Article 33 of the GDPR, controllers must notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours.
In practice, notification requirements and formats have varied considerably across Member States, creating significant operational complexity for organisations active in multiple EU jurisdictions.
The standardised template directly addresses this fragmentation by providing a consistent structure for breach notifications submitted across the European Union.
It includes predefined values and recommended tools designed to assist organisations in completing the notification form efficiently and accurately.
The template is currently subject to a public consultation period, which remains open until 5 August 2026, with stakeholders invited to submit comments on its content.
Following the close of the consultation, the EDPB will determine an implementation timeline for adoption by all Data Protection Authorities within the European Union.
The plenary session also addressed the European Commission’s Digital Omnibus proposal, with the EDPB welcoming several changes while reiterating its opposition to proposed amendments regarding the definition of personal data.
The Board expressed concerns that narrowing the scope of what constitutes personal data risks significantly weakening individual data protection rights across the EU.
Organisations operating across multiple European jurisdictions are advised to monitor the consultation closely and prepare for the eventual mandatory adoption of the standardised notification framework.