Report a data breach¶

When a data breach or information security incident occurs, you need to document it quickly and thoroughly. This guide walks you through creating a breach report in Dxtra using the 5-step reporting wizard.

Prerequisites¶

• A Dxtra account with admin or DPO access
• Details of the breach (what happened, when, what data was affected)
• Knowledge of who was affected and how many individuals are involved

Start a new report¶

Go to Breach & Incident Report in the left sidebar. Below any existing reports, you see the Report a Data Breach or Information Security Incident form.

The form has five tabs across the top: Incident Details, Data & Impact, Risk & Response, Notifications, and Review & Submit. Complete each step and use the Back and Next buttons to navigate between them.

Step 1: Incident Details¶

Fill in the organization details and incident timeline:

1. Select the Data Protection Officer responsible for this incident from the dropdown
2. Enter your Internal Reference Number — your organization's tracking ID for this incident
3. Fill in the Incident Timeline:
   • Breach Occurred — The date and time the breach actually happened (if known)
   • Breach Discovered — When your organization first became aware. This is the date from which the GDPR 72-hour notification clock starts
   • Breach Ended — When the breach was contained, if applicable
   • Notification Date — When you notified (or plan to notify) the supervisory authority
4. Describe the Nature of Breach:
   • Brief Description — A short summary for quick reference
   • Detailed Incident Report — A comprehensive account of what happened, how it was discovered, and what systems or processes were involved

Click Next to proceed to Step 2.

Step 2: Data & Impact¶

Assess the scope and severity of the breach:

1. Select the Categories of Personal Data affected — names, email addresses, financial data, health records, special category data, etc.
2. List any Specific Identifiers Affected — the exact PII types compromised
3. Select the Data Protection Measures that were in place (encryption, access controls, etc.)
4. Indicate whether Encryption Keys Were Compromised — choose Yes, No, or Unknown. This significantly affects the risk assessment. If encryption keys were not compromised, the data may be considered protected even if accessed.
5. Document the Affected Individuals:
   • Select the Categories of Data Subjects (customers, employees, etc.)
   • Choose Exact Count or Range Estimate for the number of affected individuals
   • Enter the Number of Records Affected
   • Select the Geographic Scope — which countries or regions the affected individuals are located in. This determines which regulatory notification requirements apply.

Click Next to proceed to Step 3.

Step 3: Risk & Response¶

Document your risk analysis and the actions taken:

1. Write your Detailed Risk Assessment — describe your methodology and conclusions about the severity of the breach
2. Select Measures Taken from the dropdown — what immediate containment steps were applied
3. Describe Immediate Containment Actions — actions taken in the first hours after discovery
4. Describe Ongoing Mitigation Measures — continuing efforts to address the breach and prevent further exposure
5. Describe Long-term Improvements — preventive measures you plan to implement
6. Document Evidence Preservation — how evidence is being secured for potential investigations or legal proceedings

Click Next to proceed to Step 4.

Step 4: Notifications¶

Track who needs to be notified and what actions to recommend:

1. Regulatory Notification — Select whether regulatory notification is required:
   • Yes — Notification is required
   • No — Notification is not required (e.g. the breach is unlikely to result in risk to individuals)
   • Under Assessment — Still determining whether notification is required
2. List any Other Authorities Notified — additional supervisory authorities, sector regulators, or law enforcement
3. Individual Notifications — Check the recommended actions you are advising affected individuals to take:
   • Change Passwords
   • Enable Multi-Factor Authentication
   • Monitor Financial Accounts
   • Consider Credit Freezes
   • Place Fraud Alert
   • Watch for Phishing Attempts
   • Review Account Statements
   • Report Suspicious Activity
   • Contact Support for Questions
4. Document any Other Processors/Controllers that were involved in or notified about the breach
5. Note any Other Third Parties Involved (e.g. forensic investigators, legal counsel)

Click Next to proceed to Step 5.

Step 5: Review & Submit¶

Finalize the report:

1. Evidence & Documentation — Upload supporting files. The evidence table shows each attachment with its category, file name, size, and upload date. Typical attachments include:

   • Audit log extracts
   • Regulatory notification drafts
   • Incident timeline diagrams
   • Customer notification templates
   • Affected accounts summaries

2. Declaration & Submission:

   • Your name and role are auto-populated
   • Enter your position in the organization
   • The submission date and time are recorded automatically
   • Check the certification checkbox to confirm the information is accurate and complete
   • Type your name as your Electronic Signature

3. Choose your action:

   • Save Draft — Save the report and return to it later. The Report Status shows "This report is saved as a Draft."
   • Submit Report — Finalize and submit. The report moves from Draft to submitted status in the Breach Reports list.
   • Cancel — Discard changes and return to the list

After submission¶

Once submitted, the report appears in the Breach Reports list at the top of the page.

Breach reference number¶

Dxtra assigns each breach report a unique reference number in the format:

{ControllerPrefix}-SEC-{Year}-{Sequence}

For example, DCI-SEC-2026-0023 means: controller prefix DCI, category SEC (security), year 2026, and sequence number 0023. The controller prefix is derived from your organization's name during onboarding.

Breach report list columns¶

The breach report list displays the following columns:

You can update a submitted report by clicking the edit action. This creates a new version while preserving the original submission for audit purposes.

Field reference¶

This section documents every field across the five report tabs. Use it as a reference when completing a breach report or when reviewing submitted reports.

Tab 1: Incident Details (10 fields)¶

Organization Details — Identify the responsible officer and internal reference for this incident.

Incident Timeline — Record when the breach occurred, was discovered, and when notifications were made. GDPR requires notification within 72 hours of discovery.

Nature of Breach — Describe the type, category, and details of the security incident.

Tab 2: Data & Impact (10 fields)¶

Personal Data Affected — Identify the categories and protection status of personal data involved in the breach.

Affected Individuals — Identify who was affected by the breach and the approximate number of individuals.

Tab 3: Risk & Response (9 fields)¶

Risk Assessment — Evaluate the risk to affected individuals based on the nature of the data, volume affected, and potential consequences.

Response Actions — Document the measures taken to contain the breach and prevent recurrence.

Tab 4: Notifications (10 fields)¶

Regulatory Notifications — Track notifications to supervisory authorities and affected individuals.

Individual Notifications — Document communications with affected individuals.

Third Parties & Processors — Identify data processors and third parties involved in or affected by the breach.

Tab 5: Review & Submit (8 fields)¶

Lessons Learned — Document findings and improvements to prevent future incidents.

Remediation Action Plan — Track specific actions with owners and deadlines.

Supporting Documentation — Attach relevant documents, evidence, and communications.

Declaration & Submission — Complete the declaration to certify the accuracy of this report.

Fields marked with * are required.

Related¶

• Breach & incident management overview — The 5-step workflow and notification deadlines
• Breach response plan — Develop your incident response plan
• Data subject rights management — Managing requests that may follow a breach notification
• Compliance issues — Track issues arising from breaches