A breach notification letter is often the only part of an incident that customers ever see, and a vague, late or legally incomplete letter turns a security incident into a trust and regulatory problem. This template gives [Organisation] a ready-to-adapt letter for individuals affected by a personal data breach, plus the procedure around it: when a letter is required, who signs it off, which facts must be confirmed first, and what it must contain under UK and EU GDPR Article 34 and representative US state laws. It is written for privacy, legal, incident response and communications teams. It does not decide whether you must notify a regulator: for the full set of clocks, use the Data Breach Notification Checklist. Replace every [placeholder] and confirm the final text with counsel.
How to use this template
- Adopt it as an annex to [Organisation]'s incident response plan and breach notification procedure. See the Incident Response Plan Template.
- Prepare it before an incident. Agree the structure, approvers, sign-off routes, helpline scripts and mailing supplier in advance, so that only the incident facts are written under pressure.
- Keep one master letter and add jurisdiction inserts from section 7.3. Many incidents affect people in several countries or US states at once.
- Use the section headings in section 7.2 unchanged. They follow the structure of the US Federal Trade Commission (FTC) model letter and make the letter easy to scan.
- Record every decision (notify or not, timing, content approval) in the breach register with the time and the person who decided.
1. Scope and triggers
1.1 This template applies when personal data of [Organisation]'s customers, users, patients or other individuals is involved in a confirmed or reasonably suspected breach, whether held by [Organisation] or by a processor or supplier on its behalf.
1.2 A letter to individuals is triggered when any of the following applies:
| Regime | Trigger for telling individuals | Timing |
|---|---|---|
| UK GDPR and EU GDPR Art. 34 | The breach is likely to result in a high risk to the rights and freedoms of natural persons | Without undue delay |
| Washington RCW 19.255.010 | Breach of unsecured personal information of Washington residents (or of secured data where the key was also acquired) | No more than 30 calendar days after discovery, subject to a law enforcement delay |
| New York General Business Law 899-aa | Breach of private information of New York residents | Most expedient time possible and within 30 days of discovery, subject to a law enforcement delay |
| Other US states | Defined by each state's statute | [Insert from counsel's state matrix] |
| Contracts | Customer, partner or card scheme agreements | [Insert contractual deadlines] |
1.3 The GDPR threshold for telling individuals is higher than for notifying the regulator. The ICO advises weighing both the severity of the potential impact and its likelihood, and documenting the reasoning if you decide not to tell people.
1.4 Article 34(3) lists three situations where the communication is not required: the data was protected by measures that make it unintelligible to unauthorised people, such as encryption; subsequent measures mean the high risk is no longer likely to materialise; or individual communication would involve disproportionate effort, in which case a public communication that informs people equally effectively is needed instead. The regulator can still require [Organisation] to notify.
2. Roles and contacts
| Role | Named lead | Responsibility for the letter |
|---|---|---|
| Breach lead or DPO | [Name, phone] | Decides whether individual notice is required, owns the timeline, is the contact point named in the letter |
| Legal counsel | [Name, phone] | Confirms applicable laws and jurisdiction inserts, approves final wording, handles law enforcement delay requests |
| Incident response lead | [Name] | Supplies and confirms the facts: what happened, dates, data types, containment status |
| Communications lead | [Name] | Plain language editing, website notice, media statement, consistency across channels |
| Customer service lead | [Name] | Helpline set-up, scripts, staffing, escalation of distressed or vulnerable callers |
| Executive signatory | [Name, title] | Signs the letter and accepts accountability |
| Mailing or email supplier | [Supplier, contract reference] | Address cleansing, printing, sending, delivery and bounce reporting |
2.1 Agree the external support contracts (mailing, call centre, credit monitoring or identity protection) before an incident. Procuring them during one usually delays the letter by days. See the Incident Communication Plan Template.
3. Detection and triage
3.1 Before drafting, the incident response lead confirms in writing the facts the letter depends on. Each fact is marked confirmed, probable or unknown.
- Dates: date or window of the breach, date of discovery, date contained. Washington requires the time frame of exposure, if known, including the date of the breach and the date of discovery.
- Data types: the categories of personal data involved for each group of people (for example name and email address, or name, date of birth and passport number). Different groups may need different letters.
- Population: the number of affected individuals and their countries or states of residence, which decides the jurisdiction inserts and regulator copies.
- Cause: a short, non-technical description (for example, "an unauthorised person used a stolen employee password to access a customer database").
- Misuse: any evidence that the data has been published, sold or used, for example on a leak site. See the Ransomware Data Leak Site Listing Playbook.
3.2 Decision (breach lead with legal): notify individuals, notify publicly under Art. 34(3)(c), or do not notify with documented reasons. Record the decision and the risk assessment that supports it.
4. Containment
4.1 The letter describes what [Organisation] has done to stop the breach. Only state containment measures that are complete; describe ongoing work as ongoing.
4.2 Law enforcement timing. New York and Washington both allow notice to be delayed where a law enforcement agency determines that notification would impede a criminal investigation, with notice following once the agency agrees. Recital 88 of the GDPR also recognises that early disclosure should not unnecessarily hamper investigations. Any delay request must come from the agency and be recorded in writing. The FTC advises coordinating the timing of notices with the investigating law enforcement agency. See the Engaging Law Enforcement During a Cyber Incident Guide.
4.3 Never delay the letter to finish a full forensic report. Send it when the facts in 3.1 are confirmed to a reasonable degree, and send an update if they change.
5. Eradication
5.1 Describe the measures taken to remove the cause and prevent recurrence in plain terms: for example "we reset all staff passwords, required multi-factor authentication on the affected system and removed the attacker's access".
5.2 Avoid absolute claims such as "fully secure" or "no risk to you". If the cause was a supplier, say so factually and say what [Organisation] has required of the supplier.
6. Recovery
6.1 Choose the support offered to recipients according to the data involved:
| Data involved | Advice and support in the letter |
|---|---|
| Passwords or account credentials | Forced password reset, advice not to reuse passwords, enable multi-factor authentication |
| Email address or phone number | Warning about phishing and scam calls that mention the breach; how [Organisation] will and will not contact them |
| US Social Security numbers or financial data | Free fraud alert (lasts one year, renewable), free credit freeze with each bureau, credit reports, IdentityTheft.gov; credit monitoring or identity protection for at least a year, as the FTC suggests |
| Payment card data | Check statements, contact the card issuer, card replacement where issued by [Organisation] |
| Identity documents | How to report to the issuing authority; watch for fraudulent applications |
| Health or other special category data | Named contact for sensitive questions; support services where appropriate |
6.2 For the consumer side of these steps, link recipients to plain guidance such as the Credit Freezes and Fraud Alerts Guide and the What to Do After a Data Breach Guide.
7. Communication and notification
7.1 Minimum content. Under Art. 34(2) the letter must describe in clear and plain language the nature of the breach and contain at least: the name and contact details of the DPO or other contact point; the likely consequences of the breach; and the measures taken or proposed to address it, including measures to mitigate possible adverse effects (Art. 33(3)(b) to (d)). New York requires contact details, the telephone numbers and websites of relevant state and federal agencies, and the categories of information involved. Washington requires the business name and contact details, the types of personal information, the time frame of exposure if known, and, where personal information was exposed, the toll-free numbers and addresses of the major credit reporting agencies.
7.2 Model letter.
[Organisation logo] · [Date] · NOTICE OF DATA BREACH
Dear [First name],
We are writing to tell you about an incident that involved some of your personal information. We are sorry this has happened.
What happened? On [date], we discovered that [plain description of cause]. The incident took place between [start date] and [end date]. [We contained it on (date).]
What information was involved? The information involved was your [list the data types for this recipient group]. [Your (data types not involved) were not affected.]
What we are doing. We [containment and eradication measures]. We have reported the incident to [regulator] [and to (law enforcement agency), with its agreement to name it].
What you can do. [Advice from section 6.1 for this data type.] [To activate (service), which is free for (period), visit (URL) and use code (code) by (date).]
Other important information. We will never ask for your password, full card number or one-time codes by email, phone or text. If you receive a message that claims to be from us about this incident, contact us using the details below.
For more information. Call [helpline number] ([hours]), visit [incident web page] or contact our Data Protection Officer at [email, postal address]. You have the right to complain to [supervisory authority, with contact details].
Yours sincerely, [Name], [Title], [Organisation]
7.3 Jurisdiction inserts (legal to confirm before each use): New York: the telephone numbers and websites of relevant state and federal agencies. Washington: the credit reporting agencies' toll-free numbers and addresses where personal information was exposed. Other states: [insert per counsel's matrix].
7.4 Channels. Use post or email to known addresses, plus a web page and a helpline. Do not include links that ask for a password in an email notice: the letter itself becomes a phishing template. Tell people how and when [Organisation] will contact them again, as the FTC recommends.
7.5 Regulator copies. Where more than 500 California residents are notified, a single sample copy of the notice (with no personal information) is submitted electronically to the California Attorney General. Where more than 500 Washington residents are notified, the Washington Attorney General is notified within 30 days of discovery. New York requires notice to the Attorney General, the Department of State and the Division of State Police about the timing, content and distribution of the notices, with a copy of the template.
7.6 Plain language check. Before sign-off, a person outside the incident team reads the letter and explains back what happened, what data was involved and what they should do. Remove jargon such as "threat actor", "exfiltration" or "unauthorised access event".
8. Post-incident review
8.1 Within [30] days of the final mailing, review: time from discovery to first letter, delivery and bounce rates, helpline call volumes and top questions, complaints received, regulator feedback and uptake of any support service.
8.2 Update this template with the lessons learned, including any letter wording that caused confusion. Keep the final letters, mailing lists, delivery evidence and approval records with the breach register for [retention period].
Implementation guidance
- Pre-approve the skeleton. Have legal and communications approve the structure in 7.2 and the standard paragraphs now, leaving only incident facts in brackets.
- Build the jurisdiction matrix. List every country and US state where [Organisation] holds personal data, with content and regulator copy requirements, reviewed [annually] by counsel. Laws change, so check current text before each use.
- Contract the suppliers. Mailing, call centre and identity protection providers on standby, with tested data transfer routes.
- Exercise it. Draft a letter from a scenario in each tabletop exercise and time the approval route. See the Tabletop Exercise Guide.
- Measure. Track time from the notification decision to dispatch, percentage of letters delivered, helpline answer times, and the number of corrections or follow-up letters needed.
Common failure patterns to avoid: letters that understate the data involved and need a correction later; generic letters that do not say what the recipient should do; sending from a new, unfamiliar domain, which looks like phishing; one letter for all recipients when data types differ; and waiting for forensic certainty past a statutory deadline.
Related NHI Mgmt Group resources: Data Breach Notification Checklist · Breach Notification Laws by Country Guide · Incident Communication Plan Template · GDPR Compliance Guide for Security Teams. This guide summarises notification letter requirements under GDPR Article 34 and selected US state laws and is not legal advice.