Skip to content
Skip to content

You record the breach, copy the two letters we prepare from your answers, send them yourself, record that you sent them, and then close the incident.

The Breach register is your own record of a breach of personal data, wherever it happened. We turn your answers into two letters. We do not send them. You send them yourself, and the register keeps a dated record of when you say you did.

  1. 1 Record the breach. Open the Breach register from your account menu and answer eight questions. The time you became aware starts the Board's 72-hour clock. The law gives you 72 hours to report to the Data Protection Board and asks you to tell the affected people without delay (DPDP Rules, Rule 7). Our guide explains what the 72-hour rule requires.
  2. 2 If you do not know everything yet, mark questions 6 to 8 as not known yet. Fill them in when you learn more.
  3. 3 Read the two breach letters. One is for the people affected and one is for the Board. Copy each and send it yourself.
  4. 4 After you send a letter, record it as sent. The screen keeps a dated copy of the text.
  5. 5 Close the incident once both letters are recorded as sent.

While a letter is not recorded as sent, Home shows a breach banner. A notification and a line in the daily summary repeat it.

Two other things can go wrong around a breach. A client may say someone else opened their link. A screen may show Try again or Not in your role. If something else is not working, contact support.

For example

At 10:00 on 1 July 2027, Amaltas Deshmukh & Co finds that an office laptop holding client documents is missing. An admin records a breach with 10:00 on 1 July 2027 as When you became aware of it. Under Who was affected the admin chooses Some of them and enters 2 as How many people. The register shows Board report due by 10:00 on 4 July 2027, which is 72 hours later. Amaltas Deshmukh & Co does not yet know how it happened, so the admin ticks Not known yet on questions 6, 7 and 8. Home shows the banner. It sends the people's letter on 1 July 2027 and records it that day. On 2 July 2027 it sends the Board's report and records it, and the banner goes. On 3 July 2027 it learns how the laptop went missing. It enters that under question 6 and records an update to the Board. On 5 July 2027 the admin writes how it ended and closes the incident.