📌
Nature of the Breach
Precise description of what happened — unauthorised access, accidental disclosure, ransomware, insider threat — with known or estimated date and time of occurrence and discovery.
👥
Categories & Number Affected
Categories of personal data affected (names, financial data, health records, etc.) and the approximate number of Data Principals whose data was compromised.
⚠️
Likely Consequences
Assessment of likely harm to affected individuals — financial loss, identity theft risk, reputational damage, physical harm — and the severity of the risk posed by the breach.
🔧
Remedial Measures Taken
Steps taken or proposed to address the breach — containment actions, system fixes, access revocations, and measures to prevent recurrence — demonstrating active remediation.
📬
Contact Details
Name and contact information of the Grievance Officer or data protection point of contact — so the Board and affected individuals have a direct line for follow-up queries.
🆘
Advice to Affected Users
Practical steps affected individuals should take to protect themselves — changing passwords, monitoring bank accounts, placing fraud alerts — demonstrating your duty of care beyond just notification.