The new EDPB template for personal data breach notification: simplification of breach reporting?

64% of CISOs spend between 4 and 24 hours reporting a security incident to the competent authority, and that is before incident response has even begun. Those figures, drawn from a recent ECSO survey, illustrate what anyone who has lived through a personal data breach already knows: completing the notification form is only part of the problem, but it is the part that demands the most time at the worst possible moment. 

On 10 June 2026, the European Data Protection Board (the “EDPB”) published a common template for personal data breach notifications to national data protection authorities under article 33 of the General Data Protection Regulation (GDPR). The timing is not coincidental: the template forms part of the EDPB’s Helsinki Statement commitment to making GDPR compliance more straightforward. It also coincides with negotiations on the Digital Omnibus Regulation, the EU legislative package designed to simplify and modernise a range of digital rules. The Omnibus likewise proposes to reform article 33 GDPR: to raise the notification threshold, to extend the deadline from 72 to 96 hours, and, most relevantly here, to mandate the EDPB to establish a common notification template. The current EDPB template thus anticipates a statutory obligation that has yet to formalise its own mandate. For a full overview of the Digital Omnibus proposal, please refer to our earlier blog post on the subject. 

The template is open for public consultation until 5 August 2026. We have analysed it, compared it with the form used by the Belgian Data Protection Authority (the “Belgian DPA”), and offer a critical assessment. 

What does the template contain? 

The template is designed primarily for implementation through an IT system by national data protection authorities. It comprises approximately 100 fields across seven sections, with predefined answer options and conditional logic. It follows the structure of article 33(3) GDPR but goes substantively beyond the statutory minimum. Its structure is as follows: 

• type of notification; 
• identity of the controller and the reporting person; 
• facts of the breach, consequences, and measures; 
• further information on the breach; 
• communication to data subjects;
• other possible issues; 
• attachments. 

The template has a number of strengths: 

• It structures the notification systematically around the CIA triad (confidentiality, integrity, availability) and poses targeted follow-up questions for each type, including whether data have actually been exfiltrated or are merely likely to have been, and whether protective measures could be circumvented. 
• It draws an explicit distinction between measures to address the current breach (section 4.3) and measures to prevent future breaches (section 4.4), a distinction that is materially relevant to the article 34 risk threshold assessment but absent from several national forms. 
• It requests the number of affected data subjects (section 3.3) and the number of affected records (section 3.4) as separate fields, with a practical tooltip explaining why “500 records” may conceal two entirely different risk profiles. 
• Follow-up and withdrawal logic is built in: a notification may be marked as complete, incomplete, or withdrawn, with fields for an internal reference number and the identifier of the prior notification. This is essential for ransomware incidents reported in multiple phases. 
• Finally, the template expressly asks how the breach was discovered (internal detection, notification by a processor, a data subject, an external party, or the press), an element frequently absent from national forms and relevant to the assessment of the notification deadline. 

There are, however, notable omissions. 

• The template is deliberately neutral as to national law: it does not reference national legal bases (in Belgium, for instance, the Law on Electronic Communications or the Code of Economic Law), sector-specific competent authorities (the BIPT for telecoms operators), or parallel notification obligations to the VTC (Flemish bodies) or the National Bank of Belgium (NBB) (for financial service providers under PSD2). 
• Data categorisation remains relatively abstract. The Belgian DPA’s form is more granular, offering options such as national registration number, CCTV footage, HR data, and smart grid data, and in that respect goes further than the EDPB template. 

This is a logical consequence of the pan-European scope, but it means that the Belgian DPA’s guidance remains indispensable as an operational complement. 

Will the template become binding? 

Not yet, and whether and when that will happen remains uncertain. Following the public consultation, the EDPB will decide on an implementation timeline for national data protection authorities. The template has no legal basis compelling national authorities to adopt it, and the EDPB cannot impose it by means of a binding instrument under the current GDPR framework. 

That could change through the Digital Omnibus proposal, which would amend the existing article 33 GDPR and expressly mandate the EDPB to establish a common notification template and a list of circumstances in which a breach gives rise to high risk, both to be reviewed every three years. The current template therefore anticipates a statutory obligation that would formalise its own mandate. Whether the Omnibus proposal will survive the trilogue in that form is uncertain: the EDPB and the European Data Protection Supervisor (EDPS), in their joint opinion of February 2026, were critical of other aspects of the proposal, including the proposed raising of the notification threshold to “high risk” and the extension of the deadline from 72 to 96 hours. 

The question whether the EDPB template is descriptive, a mapping of existing national forms or prescriptive, a new standard intended to supersede national templates, remains unanswered for the time being. The answer will depend on the extent to which national data protection authorities revise their forms following the consultation, and on the outcome of the Omnibus negotiations. 

The Belgian DPA substantially revised its notification form in late 2024/early 2025, introducing a multi-phase notification structure. If it does not align its form with the EDPB template, the template will have limited operational impact for day-to-day Belgian practice. 

Does the template solve the real problem? 

The threshold, not the form 

The 72 hours are not lost filling in a form. They are lost establishing what has happened with sufficient certainty, and determining whether the breach meets the notification threshold. The qualitative threshold analysis (“is it likely that the breach will result in a risk to the rights and freedoms of individuals?”) requires a factual investigation that this template does not shorten. The EDPB formally adopted the ENISA risk assessment methodology as a tool in its Guidelines 9/2022. Even with that instrument, however, the question “from what point does the risk weigh sufficiently heavily?” remains a qualitative judgement with no formal minimum threshold in EDPB guidance. 

AI incidents: the accuracy risk 

The template assumes that the facts of a breach can be established with reasonable certainty within 72 hours. That assumption is increasingly difficult to sustain in the context of AI-related incidents. Consider an organisation that uses a generative AI model as part of a customer portal. A user reports that the model is returning personal data belonging to other users in its responses, a classic example of what the EDPB describes in Opinion 28/2024 as leakage and regurgitation of personal data by AI models. The cause may lie in the training data, in a prompt injection by a third party, in a misconfiguration of the retrieval layer, or in a combination of those factors. Determining precisely which personal data have been exposed, belonging to how many data subjects, and whether there has been exfiltration or merely unauthorised disclosure, is often impossible within 72 hours without a cyber-forensic investigation of the model itself, technically far more complex than investigating a straightforward database breach. The template offers the “incomplete notification” option, but that merely defers the moment of factual analysis. The Belgian DPA further clarifies in its guidance that it expects a full cyber-forensic investigation for hacking incidents, including exfiltration analysis and log review. That expectation is difficult to meet in the context of AI incidents, particularly within the usual timeframes. 

The Belgian multi-phase notification structure 

The Belgian DPA introduced a two-phase notification structure in late 2024/early 2025. Organisations may submit an initial (incomplete) notification within 72 hours, followed by a supplementary notification within 21 days as the investigation progresses. This aligns with the “incomplete notification” option in the EDPB template and with the possibility under article 33(4) GDPR to provide information in phases. The Belgian DPA logic and the EDPB template logic are consistent in this regard, which is a positive signal for potential future integration. The forms themselves are not, however, seamlessly aligned: the Belgian DPA requires specific fields in a supplementary notification that do not correspond directly to the follow-up fields in the EDPB template, which may result in duplication of effort for cross-border incidents. 

The authentication problem 

For day-to-day Belgian practice, a further obstacle exists that no template resolves: authentication on the Belgian DPA’s new platform. The legal representative of an organisation must first assign a role to the DPO or an authorised representative within the Belgian DPA system (the GBA_Documentum_Vertegenwoordiger profile). For Belgian organisations whose legal representative is an international or EU-based director without an eIDAS login and therefore unable to assign that role, this creates a practical problem. This is a structural operational obstacle that must be resolved irrespective of which template is introduced. 

Harmonisation: the broader context 

The EDPB template is one step in a broader harmonisation landscape. DORA already has a harmonised notification template laid down in a delegated regulation. The NIS2 Cooperation Group is working on a comparable instrument by means of an implementing act. The Digital Omnibus seeks to consolidate these in an ENISA-managed single entry point. This ambition is directly relevant to any organisation falling under multiple regimes: a financial institution that is both a NIS2 entity and a DORA subject must today report the same incident to the Centre for Cybersecurity Belgium (CCB), to its sectoral supervisor, and to the Belgian DPA, each with its own timeline, template, and threshold. 

The INCIDENTRON project (Grant Agreement No. 101249201), in which Timelex participates, analyses precisely this landscape: how can notification obligations be integrated without creating information asymmetry between supervisory authorities or reducing the quality of individual notifications? The EDPB template is one building block, but integration with other notification systems remains the critical variable. 

Conclusion 

The EDPB template is analytically superior to many national forms, and the direction of harmonisation is the right one. Its impact on simplification will, however, depend on factors that remain uncertain: 

• whether national data protection authorities will revise their forms; 
• how the Digital Omnibus regulates mandatory use of the template by national authorities and addresses the threshold problem; and 
• whether the real bottleneck, the qualitative threshold analysis and the cyber-forensic investigation, is supported by tools that go further than a standardised field. 

A template is the least costly simplification the EDPB could offer. That is both its merit and its limitation. 

The public consultation closes on 5 August 2026. Organisations and their advisers who struggle with the current fragmentation of notification obligations have a unique opportunity to submit concrete, practice-based feedback and thereby help shape the further development of both the template and the Digital Omnibus negotiations.