====================================================================
STARTING TEMPLATE from dpdprules.org
Personal data breach intimation to the Data Protection Board

Practical recommendation, not legal advice. Have your legal counsel
review and adapt this before use. Bracketed text marks what you must
fill in.

Provisions tracked: Rule 7(2) of the DPDP Rules 2025 (staged
intimation to the Board) and section 8(6) of the DPDP Act 2023.
These sit in the commencement group due eighteen months from the
publication gazette; the computed date 13 May 2027 is interpretation
until officially confirmed. Verified source references:
https://dpdprules.org/rules/7 and https://dpdprules.org/act/8
====================================================================

Rule 7(2) stages the Board intimation in two parts. Both clocks
start when the organisation becomes aware of the breach.

--------------------------------------------------------------------
STAGE ONE: without delay
--------------------------------------------------------------------

To: Data Protection Board of India
From: [organisation legal name]
Date and time of this intimation: [timestamp]
Contact: [name or role, channel]

Description of the personal data breach:
  Nature of the breach: [what kind of breach]
  Extent: [systems, records and number of persons affected, as
  known now]
  Timing: [when it occurred or was detected]
  Location of occurrence: [where]
  Likely impact: [assessment as known now]

We became aware of the breach on [date and time]. Detailed
information follows within seventy two hours in accordance with
Rule 7(2)(b).

--------------------------------------------------------------------
STAGE TWO: within seventy two hours of becoming aware
[or the longer period the Board allows on a written request]
--------------------------------------------------------------------

To: Data Protection Board of India
From: [organisation legal name]
Reference: our intimation of [date]

1. Updated and detailed description of the breach
   [Update every stage one item with what is now known.]

2. Events, circumstances and reasons
   [The broad facts about the events, circumstances and reasons
   leading to the breach.]

3. Mitigation
   [Measures implemented or proposed, if any, to mitigate risk.]

4. Findings about the person who caused the breach
   [Any findings regarding the person who caused the breach, if
   known.]

5. Remedial measures against recurrence
   [Remedial measures taken to prevent recurrence of the breach.]

6. Report on intimations to affected Data Principals
   [A report regarding the intimations given to affected persons:
   when, how, how many.]

--------------------------------------------------------------------
Checklist
--------------------------------------------------------------------

1. Stage one goes without delay; do not hold it for the full facts.
2. Stage two lands within seventy two hours of awareness unless the
   Board has allowed longer on a request made in writing.
3. The awareness moment is recorded in the incident log, because
   both clocks run from it.
4. The intimation to affected Data Principals runs in parallel; it
   is not sequenced after the Board intimation.