Purpose of This Template
When hackers stole personal information on over 520,000 people from the University of Copenhagen, the institution faced a series of obligations under Articles 33 and 34 of the GDPR: notify the supervisory authority within 72 hours, assess individual risk, communicate with affected data subjects, and document every decision. Universities hold particularly sensitive datasets, student records, research data, employment files, health information from campus clinics, but often operate with decentralized IT systems and limited security budgets.
This template provides a structured breach response plan tailored to the operational realities of educational institutions. It's designed to be printed, filled in during the first hour of a suspected breach, and used as your decision log for supervisory authority reporting.
Prerequisites
Before you customize this template, ensure you have:
A current data inventory. You can't assess breach impact if you don't know what systems hold personal data. Map your student information system, HR database, research repositories, alumni records, and any cloud services processing personal data on your behalf.
Defined roles. Determine who convenes the breach response team and who has authority to notify the supervisory authority. In universities, this often involves IT, legal, communications, and academic leadership. Assign these roles now, not during a crisis.
Processor contact details. If your student portal or email system is provided by a processor, you need their security contact and contractual breach notification terms (Article 28(3)(f) requires processors to notify you "without undue delay"). Keep this list current.
Pre-drafted notification language. You'll need both supervisory authority and data subject notification templates. The template below includes placeholders, but legal review should happen before the breach, not during it.
The Template
UNIVERSITY PERSONAL DATA BREACH RESPONSE LOG
Breach ID: [YYYY-MM-DD-001]
Discovery date/time: ___________
Discovered by: ___________
Initial severity (circle): Low / Medium / High / Critical
HOUR 0-2: CONTAINMENT & ASSESSMENT
☐ Convene breach response team (list attendees):
- IT Security: ___________
- DPO: ___________
- Legal: ___________
- Communications: ___________
☐ Isolate affected systems (describe action taken):
☐ Identify data categories compromised (check all that apply): ☐ Student identification (names, IDs, contact details) ☐ Academic records (grades, transcripts, disciplinary files) ☐ Financial information (tuition payments, bank details) ☐ Special category data (health records, disability accommodations, ethnic origin for diversity monitoring) ☐ Research participant data ☐ Staff employment records ☐ Alumni data ☐ Other: ___________
☐ Estimate number of affected individuals: ___________
☐ Determine if processor was involved:
- Processor name: ___________
- Processor notified at (date/time): ___________
- Processor breach reference: ___________
HOUR 2-24: SUPERVISORY AUTHORITY NOTIFICATION DECISION
Article 33 Assessment: Does this breach require notification to the supervisory authority?
☐ YES, if it's "likely to result in a risk to the rights and freedoms of natural persons"
☐ NO, if "unlikely to result in a risk" (document reasoning):
If YES, complete within 72 hours of awareness:
Supervisory authority: ___________
Notification method: ☐ Online portal ☐ Email ☐ Secure upload
Notification sent at (date/time): ___________
Reference number: ___________
Required Article 33(3) elements: ☐ Nature of breach described ☐ Categories and approximate number of data subjects ☐ Categories and approximate number of records ☐ DPO contact details provided ☐ Likely consequences described ☐ Measures taken/proposed described
If information not available within 72 hours: ☐ Phase 1 notification sent with available information ☐ Phase 2 notification scheduled for: ___________
HOUR 24-72: INDIVIDUAL NOTIFICATION DECISION
Article 34 Assessment: Does this breach require direct notification to affected individuals?
☐ YES, if it's "likely to result in a high risk to the rights and freedoms"
☐ NO, if one of these applies:
- ☐ Appropriate technical and organisational measures applied (e.g., encryption rendered data unintelligible)
- ☐ Subsequent measures taken to ensure high risk no longer likely
- ☐ Notification would involve disproportionate effort (public communication instead)
If YES, notification must include (Article 34(2)): ☐ Nature of breach in clear and plain language ☐ DPO contact details ☐ Likely consequences described ☐ Measures taken/proposed described
Communication channels: ☐ Direct email to institutional addresses ☐ Postal mail to home addresses (for alumni/former students) ☐ Secure portal message ☐ Public website notice (if disproportionate effort exception applies)
Draft approved by: ___________
Sent at (date/time): ___________
ONGOING: DOCUMENTATION & LESSONS
Article 33(5) breach register entry: ☐ Facts documented ☐ Effects documented ☐ Remedial action documented
Post-incident review scheduled for: ___________
Identified gaps:
Action items assigned: ___________
Customization Tips
For multi-campus institutions: Add a "Campus/Faculty" field at the top. Decentralized universities often discover breaches in one department that affect data held centrally. Your template should capture where the breach originated and which systems are implicated.
For research-intensive universities: Expand the data categories section to distinguish between research data subject to informed consent and administrative data processed under Article 6(1)(e) (public task). Research participant data may trigger additional ethical review board notification, not just GDPR obligations.
For institutions with significant international student populations: Add fields for cross-border transfer considerations. If the breach affects students from outside the EEA, you may need to assess whether Standard Contractual Clauses or other transfer mechanisms were in place and whether the breach affects their adequacy.
For institutions using multiple processors: Create a processor notification log as a separate tab. Track which processors you've notified, when they responded, and what actions they've taken. Article 28(3)(f) makes this their obligation, but you remain accountable to the supervisory authority.
Validation Steps
Before using this template: Run a tabletop exercise. Give your breach response team a scenario: "A researcher's laptop containing interview transcripts from 300 study participants was stolen from a conference hotel. The laptop was password-protected but not encrypted. What do you do in the first hour?" Walk through the template together. You'll discover missing contact details, unclear decision authority, and gaps in your data inventory.
After using it once: Compare your completed log against Article 33(5) requirements. Could you hand this document to the supervisory authority as your breach register entry? If you're missing factual details about how the breach occurred or what data was affected, your template needs more specific prompts.
Every six months: Review the "Processor contact details" section. University IT environments change constantly, new learning management systems, updated student portals, research data repositories migrated to new providers. If your processor list is outdated, you'll waste critical hours during a breach trying to determine who to notify.
The University of Copenhagen breach affecting over 520,000 individuals highlights the scale of risk universities face. Your response plan won't prevent every breach, but it will determine whether you meet your 72-hour notification deadline and whether affected individuals receive clear, timely guidance. Print this template. Fill in the organizational details now. When the call comes, you'll have a decision framework, not a blank page.
