Data Breach Notification Email to Customers: 9 Templates

A data breach notification email to customers is the message you never want to send: the one that tells the people who trusted you with their data that something went wrong. It is also one of the most consequential emails a company ever writes — legally, because breach-notification laws set out what you must disclose and how fast, and practically, because a clear, honest notice keeps trust that a vague or late one destroys.

This guide gives you nine copy-paste templates for the situations you are most likely to face — exposed contact details, stolen credentials, compromised payment or health data, a vendor's breach, the notice to enterprise customers, and the summary a regulator expects — plus what every good notice includes and how quickly the main frameworks require you to act.

One thing up front, and it runs through the whole page: this is general information, not legal advice, and breach-notification rules differ by country, state, and the kind of data involved. Use these templates as a starting point and have counsel review before you send.

When should you send a breach notification email?#

Not every security event is a reportable breach, and sending an alarming notice for a non-event erodes trust as surely as staying silent about a real one. The trigger is usually whether personal data was, or was reasonably believed to be, accessed, acquired, or disclosed without authorization — and whether that creates a risk to the people involved.

Two questions decide it. Was personal data actually exposed, and does the exposure create a risk to those individuals? If the answer to both is yes, you are almost certainly in notify territory. If the data was strongly encrypted and the keys were not taken, or nothing personal was involved, you may not be — but that is a call to make with counsel, not alone.

What a good breach notification email includes#

Whatever the jurisdiction, regulators and readers want the same core facts, and both GDPR and the US HIPAA rule converge on a similar list. A good notice answers, in plain language, six questions a worried customer will ask in the first ten seconds.

• What happened, and when? State the incident plainly and give the discovery date — and the breach date if you know it. Vagueness reads as evasion.
• What data of mine was involved? Name the exact [DATA CATEGORIES] — "name, email, and hashed password," not "certain information." Say plainly what was not affected, too.
• Am I at risk, and how? Describe the likely consequences honestly — from targeted phishing to fraud — without either minimizing or catastrophizing.
• What have you done about it? Summarize [WHAT WE DID]: how you contained it, who you brought in, and what you fixed.
• What should I do now? Give clear, specific [WHAT YOU SHOULD DO] steps: reset a password, watch statements, enable two-factor, take up credit monitoring.
• Who can I talk to? A named contact — a toll-free number, an email, a web page, or a postal address — so the reader can ask questions.

The table below maps each element to why it belongs there and the bracket you fill. It is drawn from what the two most-cited frameworks actually require, so a notice that covers every row is on solid ground in most situations.

How quickly must you report a data breach?#

Deadlines are where breach law is most often misquoted, because the famous number — GDPR's 72 hours — does not mean what most people think. It is the deadline for telling the regulator, not your customers.

Under GDPR Article 33, a controller must notify the supervisory authority "without undue delay and, where feasible, not later than 72 hours after having become aware" of a breach — unless the breach is unlikely to result in a risk to people's rights and freedoms. Notifying the affected individuals is a separate duty under Article 34: it applies when the breach is a likely "high risk" to them, and the standard is "without undue delay," with no fixed hour count.

US rules run on different clocks. The HIPAA Breach Notification Rule gives covered entities up to 60 calendar days after discovery to notify affected individuals, acting without unreasonable delay within that window. State laws — every US state has one — vary: most require notice without unreasonable delay, while roughly twenty set a numeric limit, commonly 30 to 60 days, and many also require notice to the state attorney general. Those specifics move, so check your state's current statute (as of 2026).

Nine breach notification email templates#

The templates below cover the situations you are most likely to face. Each is built from the same interchangeable brackets — [WHAT HAPPENED], [DISCOVERY DATE], [DATA CATEGORIES], [PEOPLE AFFECTED], [WHAT WE DID], [WHAT YOU SHOULD DO], and [CONTACT] — so you can swap the specifics without rebuilding the message. Fill every bracket; an unfilled bracket that ships to customers is its own embarrassment.

Keep the subject line honest and specific. "Important security notice about your account" tells the reader what this is; a vague or cheerful subject line gets deleted, and an alarmist one causes panic before they have read a word.

Template 1: Exposed contact information#

Use this when names, emails, phone numbers, or addresses were exposed, but there is no sign that passwords or payment data were involved. The main risk to the reader is targeted phishing, so name it.

Template 2: Stolen login credentials#

When usernames and passwords were exposed, the notice has to drive one action: a reset. Reset the account yourself where you can, and tell people to change any place they reused the password.

Template 3: Compromised payment data#

Payment breaches raise the stakes and the reader's anxiety. Be specific about what was and was not exposed, and point them at concrete financial steps rather than reassurance.

Template 4: A breach of health information (HIPAA)#

If you handle protected health information in the US, the HIPAA rule (45 CFR 164.404) sets specific content and a contact requirement: a toll-free number, email, website, or postal address. This template is written to that shape.

Template 5: Notifying enterprise customers#

When a business customer is the data controller and you are the processor handling data on their behalf, you notify them formally rather than emailing their end users. Your job is to support their own assessment and any notice they must make.

Template 6: The regulator-facing summary#

This is the notice to a supervisory authority, mapped to the content GDPR Article 33(3) asks for. It is deliberately factual and structured — the regulator wants the categories, the scope, the likely consequences, and the measures, in that order.

Template 7: A breach at one of your vendors#

When your customers' data was exposed in a service provider's breach, you still notify — it is your data and your relationship. Say plainly that it happened at a provider, without hiding behind them.

Template 8: The follow-up once you know more#

A single notice is rarely enough. Once the investigation closes, tell people what you confirmed — especially if the scope turned out narrower or there is no sign of misuse. This is the message that rebuilds trust.

The hard version: notifying before you know the full scope#

The templates above assume you know what happened. Real incidents rarely wait for that: often you have to tell people something while forensics is still running and the numbers keep moving — and the deadlines above may be counting down while you do.

The instinct is to wait for certainty. Usually you should not. A preliminary notice that says what you know, admits what you do not, and gives a precaution buys trust and meets the spirit of "without undue delay," as long as you follow up.

What to do when a notice gets no reply#

A breach notice is not marketing, so "no reply" is usually fine — most recipients read it, act if they need to, and move on quietly. What you actually have to watch is whether the notice was delivered, and whether the people you could not reach are handled properly.

1. 1

   Confirm delivery first

   Check for bounces and spam-folder placement. A breach email sent from an unusual address or full of alarming words can get filtered, and an undelivered notice is not notice. Send from a recognizable address and monitor delivery.

2. 2

   Send one reminder, then switch channels

   For unresolved recipients — a bounced address, or an action you asked for and can see was not taken — send a short second notice. If email keeps failing, fall back to a known second channel: postal mail, an in-app message, or a phone call for high-risk cases.

3. 3

   Use a substitute notice when you cannot reach people

   When contact details are missing or out of date for a group of people, most breach laws provide a substitute-notice route — a conspicuous notice on your website or a message to major media. GDPR Article 34 likewise allows a public communication where reaching individuals directly would take disproportionate effort. Check the threshold in the rule that applies.

4. 4

   Keep the support channel open and staffed

   The contact point in your notice will get used, especially in the days right after you send. Staff it, script answers to the predictable questions, and make sure whoever answers can see the incident facts. A dead phone number under a breach notice does more damage than the breach line itself.

5. 5

   Document every attempt

   Record what you sent, to whom, when, and through which channel, including reminders and any substitute notice. GDPR Article 33(5) requires you to document breaches and your response, and regulators — and, later, your own lawyers — will ask for exactly this.

A faster way to handle the replies that follow#

Sending the notice is only half the work. A breach email to thousands of people triggers a wave of worried replies, most of them variations on questions your template already answered, arriving while your team is still running the incident. This is the seam an AI email client can help with: AI Emaily connects to the Gmail, Outlook, or IMAP inbox you already use and drafts replies to those follow-ups in your voice, from a Personal Context brain you set rather than from your past mail.

In Copilot mode it holds every send for your one-tap approval, so a human still signs off on anything sensitive, with undo and a full audit trail. We build AI Emaily, so treat that as an interested view rather than a neutral one.

It is not a compliance tool or a mass-mailer — it will not tell you which law applies, file with a regulator, or send the original notice to your list; use counsel and a notification service for those. What it does is keep the follow-up inbox from burying your team. You can see how much it costs and start with a free trial.