GDPR breach log: spreadsheet, tool or consultant?

A spreadsheet can work if one disciplined person owns it. A tool adds a deadline clock and drafts. A consultant is the better choice for serious, sensitive or cross-border breaches. Many teams combine them.

Every controller must document all personal data breaches, notify the supervisory authority within 72 hours of becoming aware where the breach is likely to result in a risk, and tell the people affected when the risk is high [1][2]. How you organise that is up to you. Here is a fair look at three common options.

The short version

	Spreadsheet or document	GDPR Breach Log (this tool)	Consultant, DPO service or law firm
Cost	Free if you already have office software	$79 one-time	Varies widely, ask for a quote; often a retainer or hourly rate
Setup time	An hour or two to build the columns	Minutes: open the file	Days to weeks to agree a contract
72-hour deadline	You calculate and track it yourself	Countdown and overdue warning	The adviser tracks it once you call them
Notification draft	You write it	Draft with the Article 33(3) content	Written or reviewed by the adviser
Risk judgement	Yours	Yours; the tool does not decide	Expert judgement, which is the main value
Where the data sits	Wherever the file is stored or synced	Only in your browser, no upload	Shared with a third party under contract
Best for	Very few breaches, someone disciplined owns it	Small teams that want structure without a project	High-risk breaches, sensitive data, cross-border or legal exposure

Option 1: a spreadsheet or document

A spreadsheet can meet the documentation duty. Article 33(5) asks for the facts, effects and remedial action, in a form that lets the authority verify compliance [1]. It does not prescribe a format, and the EDPB says the record can even sit in your record of processing activities [3]. Our breach register template gives you the fields.

Where it works: one owner, few breaches, and the discipline to fill it in every time.

Where it breaks: nothing reminds you of the deadline, columns drift, people overwrite each other, and a file on a shared drive or cloud folder may be readable by more people than it should be. The register itself contains details about people and about your weak points.

Option 2: this tool

GDPR Breach Log is one offline HTML file. You record a breach (type, data, number of people, risk level, what happened, what you did). It keeps a 72-hour clock from the moment you were aware, with an overdue warning and a reminder to give reasons if you are late. It drafts the authority notification and a plain message to the people affected, and exports the full log as HTML or JSON.

Where it works: small and medium organisations, agencies and IT providers who want a consistent record and drafts ready under time pressure, without sending breach details to another service.

Limits, honestly:

It does not judge the risk for you. You choose the risk level.
It does not submit anything. You notify through your authority's own form or portal.
Data lives only in that browser. Export regularly and keep the export somewhere safe, or you can lose it.
It is not legal advice and does not make you compliant on its own.

Option 3: a consultant, external DPO or law firm

An experienced adviser brings what neither a spreadsheet nor a tool can: judgement on hard cases, knowledge of how your national authority works, and help with the consequences beyond the notification.

A consultant is the better choice when:

the breach involves health data, financial data, children or large numbers of people, so a wrong call on "high risk" matters a lot;
you operate in several EU countries and are not sure which authority is competent;
there is a dispute, a ransom demand, police involvement, or likely claims from the people affected;
a contract or sector rule adds its own reporting duties;
you are required to appoint a data protection officer and have no one in-house.

Downsides: cost, and the time to get someone engaged. If you only call an adviser when the breach happens, part of your 72 hours goes on finding and briefing them [1]. You also share the breach details with another party, which is normal under a contract but worth knowing.

Cost, time and risk compared

Cost. A spreadsheet costs only your time. The tool is $79 once. Advisers charge per hour, per incident or a retainer, so get a quote; we do not publish figures we cannot check.

Time. The time that matters is the time after you become aware. A ready template or tool saves the first hours. An adviser on a standing contract can move fast; one you still have to find cannot.

Risk. Infringing Articles 33 and 34 can lead to fines up to 10 million euros or 2% of worldwide annual turnover, whichever is higher [4]. That is a ceiling, not a likely amount, but missing the deadline or the documentation is an avoidable failure. The bigger risk is usually a wrong judgement on a serious breach, which is where advice is worth paying for.

A combination often works best

Many small organisations do the routine work themselves and keep an adviser for the hard cases. Record every breach the same way, every time, in a template or a tool. Call the adviser when the data is sensitive, the numbers are large, or you are unsure. Then the adviser starts from a complete record instead of a scramble.

Before deciding, read the 72-hour notification guide and when to notify individuals.

Related guides

Sources

This guide explains the rules in plain language. It is not legal advice. Check your own country's law and, when in doubt, ask a qualified adviser.