DPDP Breach Response Assistant

Commencement note: Rules 3, 5 to 16, 22 and 23 are not yet in force. The computed date is 13 May 2027, which is interpretation until officially confirmed. Basis of the computation: Publication date 13 November 2025 printed on Gazette issue No. 760, plus eighteen months. The corrigendum wording change does not affect this computation. Building ahead of the duty is the practical move. See Rule 7, official text.

When did your organisation become aware of the breach?

Both duties start on awareness, not on confirmation of details. This stays in your browser.

Duty one: intimate each affected person

Without delay, in a concise, clear and plain manner, through their user account or a registered mode of communication

Describe the breach: its nature, extent and the timing of its occurrence.Usually: security drafts, legal reviews (suggestion, not law) ·
State the consequences relevant to that person that are likely to arise.Usually: security drafts, legal reviews (suggestion, not law) ·
State the measures implemented and being implemented to mitigate risk.Usually: security (suggestion, not law) ·
State the safety measures the person may take to protect their interests.Usually: security drafts, support publishes (suggestion, not law) ·
Give business contact information of a person able to respond to their queries.Usually: compliance (suggestion, not law) ·

Duty two, stage one: describe the breach to the Board

Without delay

Send the Board a description of the breach: nature, extent, timing and location of occurrence, and the likely impact.Usually: compliance files on facts from security (suggestion, not law) ·

Duty two, stage two: detailed information to the Board

Within seventy two hours of becoming aware

Updated and detailed information in respect of the description already sent.Usually: security (suggestion, not law) ·
The broad facts related to the events, circumstances and reasons leading to the breach.Usually: security (suggestion, not law) ·
Measures implemented or proposed to mitigate risk.Usually: security (suggestion, not law) ·
Any findings regarding the person who caused the breach.Usually: security (suggestion, not law) ·
Remedial measures taken to prevent recurrence.Usually: security and cto (suggestion, not law) ·
A report regarding the intimations given to affected Data Principals.Usually: compliance (suggestion, not law) ·

A longer period than seventy two hours is possible only if the Board allows it on a request made in writing.

Checklist marks live only on this page while it is open. This workflow is legal information structured from Rule 7, not legal advice, and it never concludes that your response was sufficient.