---
schema: 1
kind: incident
title: "EDPB adopts a harmonised GDPR Article 33 breach-notification template; consultation open to 5 August"
headline: "EDPB adopts a harmonised GDPR Article 33 breach-notification template; consultation open to 5 August"
summary: "The European Data Protection Board adopted a common EU/EEA template for personal-data-breach notifications under GDPR Article 33 at its 10 June 2026 plenary, opening it for public consultation until 5 August 2026 (EDPB, 2026-06-10)."
discovered_at: "2026-06-11T05:00:02Z"
event_date: 2026-06-10
run_id: 2026-06-11-7edf1d8a
priority: notable
immediate_action: null
tags:
  - data-breach
  - law-enforcement
  - eu-nexus
regions:
  - europe
sectors:
  - public-sector
entities: []
cves: []
sources:
  - url: "https://www.edpb.europa.eu/news/news/2026/edpb-meets-eu-commissioner-mcgrath-and-adopts-common-data-breach-notification_en"
    publisher: EDPB
    role: primary
  - url: "https://www.edpb.europa.eu/our-work-tools/our-documents/other/template-personal-data-breach-notification_en"
    publisher: EDPB template
    role: corroborating
  - url: "https://www.cnil.fr/en/edpb-meets-eu-commissioner-mcgrath-and-adopts-common-data-breach-notification-template"
    publisher: CNIL
    role: corroborating
closed_sources: []
evidence: []
verification: multi-source
sourcing_note: null
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
watchlist_hit: false
actions: []
migrated_from: briefs/2026-06-11.md
---

The European Data Protection Board adopted a common EU/EEA template for personal-data-breach notifications under GDPR Article 33 at its 10 June 2026 plenary, opening it for public consultation until 5 August 2026 ([EDPB, 2026-06-10](https://www.edpb.europa.eu/news/news/2026/edpb-meets-eu-commissioner-mcgrath-and-adopts-common-data-breach-notification_en)). The template provides predefined fields aligned to Article 33 content requirements — categories of data and data subjects, approximate number of individuals affected, likely consequences, and measures taken — and is intended to replace the current patchwork of national DPA forms, reducing notification friction for cross-border incidents and for smaller organisations without dedicated DPOs ([EDPB template, 2026-06-10](https://www.edpb.europa.eu/our-work-tools/our-documents/other/template-personal-data-breach-notification_en)). After the consultation closes the EDPB will set an adoption timeline for national authorities.

**Defender takeaway:** Incident-response runbooks built around individual national-DPA notification forms should be reviewed against the harmonised schema once the post-consultation version lands (expected Q4 2026). Swiss organisations subject to nDSG Article 24 breach-notification duties will want to track convergence with the EU template for cross-border cases.