Template library

Notice of data breach

A plain-words letter telling each affected person what happened, what it could mean for them, what you have done and what they can do, with a named responder for questions. Send it without delay to every affected Data Principal once you become aware of a personal data breach.

An original template, drafted against the DPDP Act, 2023 and DPDP Rules, 2025. Not legal advice — review with counsel before use.

One of 14 DPDPA document templates, drafted in-house against the Act and the Rules. Free to generate as a Word file — no account needed for the preview.

Drafted against G.S.R. 846(E); citations open the gazette text inline.

About this document

What it covers

The placeholders this template asks you to fill in.

[Organisation Letterhead / Logo][Breach Reference ID][Date of Dispatch][Service or Product Name][Data Principal Name][Organisation Name][Describe the nature of the breach in one or two plain sentences, e.g. an unauthorised person gained access to a customer database][Describe the extent, e.g. which records and roughly how many people][Timing of the breach, e.g. between 2 and 4 March][Date of Awareness][Affected data item 1][Affected data item 2][Data items confirmed unaffected][Consequences relevant to this recipient's group — write a variant per group, e.g. because your password was exposed, someone could try to sign in as you; or, because only your email address was exposed, the main risk is convincing phishing mail][Containment step already taken, e.g. closed the access route and reset affected credentials][Mitigation step under way, e.g. engaged a forensic team; review continuing][Recipient action 1, e.g. change your password with us, and anywhere you reused it][Recipient action 2, e.g. turn on two-factor authentication in Settings][Recipient action 3, e.g. watch your bank and card statements for entries you do not recognise][Official Communication Channel][Responder Name][Responder Role][Responder Email][Responder Phone][Responder Availability, e.g. 9 am to 9 pm, seven days a week][Organisation Address]

The document