GDPR Breach Notification Template for Ecommerce

# DOCUMENT 1: ARTICLE 33 NOTIFICATION TO SUPERVISORY AUTHORITY ## 1. Organization Details Nordic Retail ApS, e-commerce retailer, acting as data controller for customer account data. ## 2. Nature of the Personal Data Breach On October 9, 2026 at approximately 15:00 CET, the IT team discovered that a database backup file had been stored in a publicly accessible cloud storage bucket since approximately September 29, 2026 (10 days of exposure). The breach was identified after an external security researcher reported the exposed bucket via email. Root cause: a misconfigured storage permission applied during a routine backup migration. ## 3. Categories and Approximate Number of Data Subjects Concerned Approximately 4,200 registered customer accounts. ## 4. Categories and Approximate Number of Personal Data Records Concerned Full names, email addresses, phone numbers, and bcrypt-hashed passwords for ~4,200 accounts. No financial card data or health data was included in the exposed backup. ## 5. Likely Consequences of the Breach Moderate risk of phishing and credential-stuffing attacks against affected individuals. Password hashes are unlikely to be reversed in the short term but pose a residual risk. No direct financial exposure identified. ## 6. Measures Taken or Proposed to Address the Breach Public access to the storage bucket was revoked within 1 hour of discovery. A forced password reset was triggered for all 4,200 affected accounts. Access logs are under review to determine if the data was accessed by unauthorized third parties beyond the reporting researcher. ## 7. Data Protection Officer / Contact Point jane@nordicretail.example, +45 00 00 00 00 ## 8. Cross-Border Processing To be confirmed by the organization — assess whether customers in other EU member states are affected and whether the lead supervisory authority mechanism applies. This document is a drafting aid, not legal advice. Have it reviewed by your DPO or legal counsel before submission. --- # DOCUMENT 2: ARTICLE 34 NOTICE TO AFFECTED DATA SUBJECTS Subject: Important security notice regarding your Nordic Retail account [Dear Customer], We are writing to inform you of a data security incident that may have affected your personal information. Between September 29 and October 9, 2026, a technical misconfiguration made a backup file containing your name, email address, phone number, and password (stored in encrypted form) temporarily accessible without authorization. What this means for you: there is a risk you could receive phishing emails or unauthorized login attempts using this information. What we have done: we immediately secured the exposed file, reset all potentially affected passwords, and are investigating the full scope of access. What we recommend you do: - Reset your password if you haven't already, and avoid reusing it elsewhere - Enable two-factor authentication if available - Be cautious of unexpected emails or calls referencing your account - Monitor your accounts for unusual activity over the coming weeks This document is a drafting aid, not legal advice. Have it reviewed by your DPO or legal counsel before submission. --- # DOCUMENT 3: INTERNAL INCIDENT LOG ## Breach Timeline | Date/Time | Event | Action Taken | Responsible | | --- | --- | --- | --- | | 2026-09-29 (est.) | Misconfigured bucket permissions applied during migration | None (undetected) | IT Infrastructure | | 2026-10-09 15:00 | External researcher reports exposed bucket | Report triaged | Security Team | | 2026-10-09 16:00 | Public access revoked | Bucket permissions corrected | IT Infrastructure | | 2026-10-09 18:00 | Forced password reset issued to all affected accounts | Reset emails sent | IT Infrastructure | | [TBC] | Access log review completed | Determine unauthorized access scope | Security Team | ## Record of Decisions | Decision | Rationale | | --- | --- | | Notify supervisory authority within 72 hours | Risk to rights and freedoms of data subjects cannot be ruled out | | Notify affected individuals directly | Password and contact data exposure creates phishing risk | ## Follow-Up Actions Required - [ ] Complete access log forensic review - [ ] Confirm whether other EU jurisdictions' authorities must be notified - [ ] Schedule post-incident review and update backup access policy