Skip to content
Skip to content

One letter is for the people affected and one is for the Data Protection Board, both written from your answers in your firm's name for you to copy and send yourself.

When you record a breach, the incident page shows two letters, each under its own heading. Both are built from your answers and update when you change an answer. Both are written in your firm's voice and signed with your firm's name as your clients see it. We do not send either one. You copy the text with Copy the text and send it yourself. Copying records nothing. Read each letter before you send it.

To the people affectedTo the Data Protection Board
Who gets itEach person you named as affected, either all your clients or the number you gaveThe Board
Built fromQuestions 1 to 5All eight answers, your firm's name, and the date and time you became aware
Opens withDear <name>,To the Data Protection Board of India
Timing on the screenNo fixed hour, only a record of when you sent itDue by a date and time, 72 hours after you became aware
Recorded as sentOnceOnce, and again each time you send an update

The law asks for both, the Board's report within 72 hours of becoming aware and the people's notice without delay (DPDP Rules, Rule 7). Our guide explains what the 72-hour rule requires.

To the people affected

The letter says what happened, what it could mean for the person, what you are doing about it, what they can do and who to contact. It is one text for everyone. The name at the top is the only thing you change for each person. Send it from your own email or WhatsApp. The register holds no list of people to write to. An admin can download your client list to work from.

To the Data Protection Board

The report names your firm as the data fiduciary and gives the date and time you became aware. It has eight parts, one for each answer. Part 4 says who was affected, either all the people whose data you hold or the number and line you gave. Part 5 gives the date and time the affected people were told, if you have already recorded that. Until then it says they are being told without delay. A part you ticked Not known yet says it is under investigation.

Once you have sent a letter, record that you sent it.