Legal and risk / Free editable template

Data breach response: the 72-hour clock template

Under UK GDPR you usually have 72 hours from becoming aware of a reportable personal data breach to tell the ICO. This board draws that window as a clock face with seven numbered steps placed at the hour they should happen, from logging the breach and containing it to the breach team meeting, the risk assessment, the reporting decision and the report itself, plus a simple guide to who you tell.

This is a planning example, not legal advice. Check your own policies, advisers and the local rules that apply to you.

Use this template →See the example ↓

No account needed · Opens as your own editable page

Preview the data breach response: the 72-hour clock

View full-size preview ↗
Data breach response: the 72-hour clock example showing 72-hour dial with timed steps, step list with target hours, who to tell at each level of risk
Everything in this example is editable. Replace the labels, move the shapes and adapt the layout to your work.

How to use this template

  1. Start the clock

    Record the time you became reasonably sure a breach happened. That is hour 0, not the time it was finally confirmed.

  2. Contain and assess

    Stop the breach getting worse, then assess the likely risk to the people affected. Keep notes of every decision and why.

  3. Decide and report

    Decide whether to report to the regulator and whether to tell the people affected. If you cannot finish in time, report what you know and follow up.

Questions about this template

Can I change the steps on the 72-hour clock?

Yes. Edit the seven numbered steps and move their markers round the clock to fit your own breach plan, keeping the deadline at 72 hours.

Do I need an account to use it?

No. Open the template and edit it in your browser. Your work saves on this device. An account is optional if you want to sync your workspace.

Can I export the finished diagram?

Yes. Use Export in the editor to save a PNG, SVG or PDF, or download an editable .epicdraw backup.

More Legal and risk templates →