Template library

Notice of data breach

A plain-words letter telling each affected person what happened, what it could mean for them, what you have done and what they can do, with a named responder for questions. Send it without delay to every affected Data Principal once you become aware of a personal data breach.

An original template, drafted against the DPDP Act, 2023 and DPDP Rules, 2025. Not legal advice — review with counsel before use.

One of 14 DPDPA document templates, drafted in-house against the Act and the Rules. Free to read and generate after a free sign-in. The first clauses are open below.

Drafted against G.S.R. 846(E); citations open the gazette text inline.

About this document

What it covers

The placeholders this template asks you to fill in.

[Organisation Letterhead / Logo][Breach Reference ID][Date of Dispatch][Service or Product Name][Data Principal Name][Organisation Name][Describe the nature of the breach in one or two plain sentences, e.g. an unauthorised person gained access to a customer database][Describe the extent, e.g. which records and roughly how many people][Timing of the breach, e.g. between 2 and 4 March][Date of Awareness][Affected data item 1][Affected data item 2][Data items confirmed unaffected][Consequences relevant to this recipient's group — write a variant per group, e.g. because your password was exposed, someone could try to sign in as you; or, because only your email address was exposed, the main risk is convincing phishing mail][Containment step already taken, e.g. closed the access route and reset affected credentials][Mitigation step under way, e.g. engaged a forensic team; review continuing][Recipient action 1, e.g. change your password with us, and anywhere you reused it][Recipient action 2, e.g. turn on two-factor authentication in Settings][Recipient action 3, e.g. watch your bank and card statements for entries you do not recognise][Official Communication Channel][Responder Name][Responder Role][Responder Email][Responder Phone][Responder Availability, e.g. 9 am to 9 pm, seven days a week][Organisation Address]

The document

The opening clauses — open to everyone

[Organisation Letterhead / Logo]

Reference: [Breach Reference ID]

Date: [Date of Dispatch]

Subject: Your [Service or Product Name] data was affected by a security incident

Dear [Data Principal Name],

We are writing because some of your personal data held by [Organisation Name] was involved in a data breach. The law asks us to tell you plainly and quickly, and this letter does that. It is being sent to your registered contact channel, as rule 7 (1) of the DPDP Rules, 2025 requires.

What happened

[Describe the nature of the breach in one or two plain sentences, e.g. an unauthorised person gained access to a customer database]. It affected [Describe the extent, e.g. which records and roughly how many people]. It happened [Timing of the breach, e.g. between 2 and 4 March]; we became aware of it on [Date of Awareness].

These items of your data were involved:

[Affected data item 1]

[Affected data item 2]

These were not involved: [Data items confirmed unaffected].

What this could mean for you

[Consequences relevant to this recipient's group — write a variant per group, e.g. because your password was exposed, someone could try to sign in as you; or, because only your email address was exposed, the main risk is convincing phishing mail]…