Insurance Europe

The General Data Protection Regulation (GDPR) entered into force on 25 May 2018. It obliges companies processing personal data to comply with new and more stringent data protection rules. One obligation is for companies to notify (personal) data breaches to the competent supervisory authority.

Companies have to submit the relevant information without undue delay and, where feasible, no later than 72 hours after having become aware of the breach. Such information includes the nature of the breach, categories and approximate number of data subjects and of personal data records concerned, likely consequences and measures taken to address and mitigate the breach.

Insurance Europe has developed a template as a possible way to meet this obligation. The suggested template could be of particular interest to SMEs and supervisory authorities. The former could rely on it instead of undertaking a descriptive exercise in the midst of a data breach, for which they may not have the resources. The latter could benefit from a standardised format allowing them to share incidents data across borders, to better detect trends and to gain insights into combatting cyberthreats across Europe.

The template is set up in such a way that the information gathered can be shared without the need to be anonymised or aggregated, as it will not be possible to identify a company through the information it submitted.

If used widely, the template could contribute to enhancing the available information and data on cyber risks, and so increase society’s cyber resilience. Currently, the lack of available information on cyber events hampers a range of stakeholders to play their role in cyber defence, notably insurers, which are limited in their ability to offer cyber risk cover and related services. This could change if insurers are granted access to the (anonymised) data that will be gathered by the national supervisory authorities as a result of the data breach provisions.

How it works

The template has three distinct sections:

1. Personal details and information on the affected company (not to be shared with third parties)
2. Details on the data breach incident as per the indications in Article 33 of the GDPR, to be sent to the national supervisory authority, where feasible, no later than 72 hours after having become aware of the breach
3. A section to be completed following the 72 hour period when more information is available on the data breach, which includes complementary data sets to gain more in-depth knowledge of the nature of the breach

The data sets in sections 2 and 3 are drafted in the form of multiple choice answers or numerical fields. Such a format will help the relevant authorities compare information across companies and sectors, and ensure that the information in both sections remains anonymous and can be safely shared with the insurance sector. 

Template for data breach notifications - Section 1

Template for data breach notifications - Section 2

Template for data breach notifications - Section 3

Template for data breach notifications under GDPR explanatory document

The template for data breach notifications has also been translated into Czech: Section 1, Section 2, Section 3.