Skip to main content
Church Member Software

Free Data Breach Log Template for Churches

UK GDPR says you must record every personal data breach, even the small ones you don’t report. This log gives you a two-page record for each breach, with prompts for everything the ICO expects to see.

  • Free
  • No sign-up
  • Word and PDF
  • Updated 19 October 2026

1. Add your church’s details

Optional. What you type goes straight into the document. It stays on your computer and isn’t sent to us.

2. Download or print

Download Word file

The Word file opens in Microsoft Word, Google Docs, Apple Pages and LibreOffice. Or download the blank PDF.

Preview

Data Breach Log

[Church name]

Fill in one of these records for every personal data breach, including small ones you decide not to report. Keep them together. They’re our breach log.

What happened

Breach number
Date and time found
Found by
When it happened

What happened?

What and who was affected

What information was involved?

Number of people affected

It included sensitive information, such as faith, health, children’s details or safeguarding records.

What we did

What did we do to contain it and reduce the harm?

Telling the ICO

If the breach is likely to put people’s rights at risk, report it to the ICO within 72 hours of finding it.

We reported it to the ICO.

Date reported
ICO reference

We didn’t report it, because:

Telling the people affected

If the risk to them is high, tell them without undue delay.

We told them.

Date
How

We didn’t need to, because:

Charity Commission

Registered charities report significant data breaches to the Charity Commission as a serious incident.

We reported it as a serious incident.

Date reported

What we’ve learned

What will we change so it doesn’t happen again?

Completed by
Date

Why you need a breach log

UK GDPR requires you to record every personal data breach: what happened, its effects and what you did about it. That applies to every breach, including ones you decide not to report. The ICO can ask to see your log.

A breach is more than a hack. An email sent to the wrong list, a lost register or a phone left on a bus all count, if personal information was lost, changed or seen by someone who shouldn’t have seen it.

The 72-hour decision

If a breach is likely to put people’s rights at risk, you must report it to the ICO within 72 hours of finding out. Church records reveal people’s faith, so a church breach is more likely to need reporting than you might think.

If you decide not to report, write down why. That reasoning is what the ICO will want to see if it asks later. Our guide to church data breaches explains who to tell and when.

How to use it

  1. Add your church’s name above, then print a few copies or save the Word file somewhere your team can find it.
  2. As soon as someone spots a breach, start a record. Fill in the date and time first, as the 72 hours start then.
  3. Contain the breach, then decide whether to report it. Write down your reasons either way.
  4. Number each record and keep them together, on paper or in one folder.

Mistakes to avoid

  • Only logging the big ones. Small breaches belong in the log too.
  • Waiting for every detail before reporting. You can report what you know within 72 hours and send the rest later.
  • Forgetting the Charity Commission. If you’re a registered charity, a significant breach is a serious incident.
  • Putting more personal details in the log than you need. Describe the information involved without copying it.

Questions churches ask

Do we have to record a breach if nobody was harmed?
Yes. You must record every personal data breach, even if you decide it doesn’t need reporting to the ICO. Note why you didn’t report it.
How quickly must a church report a data breach?
Within 72 hours of finding out, if the breach is likely to put people’s rights at risk. If the risk to them is high, tell the people affected too, without undue delay.
Is an email sent to the wrong person a data breach?
Yes. Whether you report it depends on what was in it and the risk to the people involved. Record it either way.
How long should we keep the breach log?
The law doesn’t set a period. Choose one in your data retention policy. Our template suggests 6 years.

Read next

Sources

This template follows official guidance. It isn’t legal or tax advice, so check anything you’re unsure about with HMRC, the ICO or an adviser.

A breach log that counts down for you

Church Member Software keeps your breach log online, shows the time left of the 72 hours and records when you told the ICO. Only administrators can see it.

Start your free trialSee prices