Skip to content
Skip to content

Open the Breach register from your account menu, choose Record a breach, answer the eight questions, and the next page gives you the two letters to send.

A breach incident is your own record of a breach of personal data, wherever it happened. Anyone whose role holds the Record and handle breach incidents switch can record one, and admins always can. The register is not available while your account is suspended for non-payment.

  1. 1 Open the account menu at the bottom of the left rail and choose Breach register. Then choose Record a breach.
  2. 2 Under A short name for it, enter a name of up to 120 characters. It is for your register only and is not in either letter.
  3. 3 Under When you became aware of it, enter the date and time. It cannot be in the future. The Board's 72-hour clock starts at this time, not when you save the record.
  4. 4 Under Who was affected, choose All clients or Some of them. Choose All clients if you cannot tell exactly whose data was touched.
  5. 5 If you chose Some of them, enter How many people as a whole number of at least 1. You can add a line under Which ones, in a line.
  6. 6 Answer questions 1 to 4: What happened, What this could mean for them, What you are doing about it and What they can do. Each answer can be up to 4,000 characters.
  7. 7 Answer question 5, Who they can contact. If you leave it blank, the letters use the contact in the Grievance contact name and Grievance contact email fields in Settings. That is your grievance contact. If question 5 is blank and no grievance contact is set, the form does not save.
  8. 8 Answer questions 6 to 8: How it happened, What you found and What changes so it does not happen again. Tick Not known yet beside any you cannot answer yet. What happens then is on its own page.
  9. 9 Choose Record the breach. If a question has no answer, the form names it and does not save.

The record then opens on its own page with the two breach letters ready to copy. We send nothing. You send each letter yourself and then record that you sent it.

The law gives you 72 hours from the moment you became aware to report to the Data Protection Board, and asks you to tell the affected people without delay (DPDP Rules, Rule 7). Our guide explains what the 72-hour rule requires. The incident page shows the deadline as Board report due by a date and time. The screen sets no hour for telling the people. It records when you say you did.

The register does not hold the list of people to write to. An admin can download your client list from Clients. Recording the incident puts a line on your audit trail.