Breach Intimation Letter to the Data Protection Board

[Organization Letterhead]

Date: [DD-MM-YYYY]
Reference No.: [Internal Incident ID, e.g. BR-2026-001]

To,
The Data Protection Board of India
[Address as notified]

Subject: Intimation of Personal Data Breach under Section 8(6) of the Digital Personal Data Protection Act, 2023

Sir / Madam,

1. In accordance with the obligation under Section 8(6) of the Digital Personal Data Protection Act, 2023, [Organization Name] ("the Data Fiduciary") hereby intimates the Data Protection Board of India of a personal data breach affecting personal data processed by it.

2. PARTICULARS OF THE DATA FIDUCIARY

Name: [Organization Name]
Registered Address: [Address]
Designated DPO / Contact Person: [Name, Designation]
Contact Details: [Email, Phone]

3. PARTICULARS OF THE BREACH

Date and Time of Occurrence (to the best of our knowledge): [DD-MM-YYYY, HH:MM]
Date and Time of Detection: [DD-MM-YYYY, HH:MM]
Nature of the Breach: [Brief description - e.g. unauthorized access, accidental disclosure, ransomware, misconfiguration]
Systems / Data Affected: [Description of the system and categories of personal data involved]
Approximate Number of Data Principals Affected: [Number, or best current estimate]

4. IMMEDIATE ACTIONS TAKEN

[Organization Name] has taken the following steps upon detection:
(a) [Containment action, e.g. revoked access, patched vulnerability]
(b) [Assessment action, e.g. engaged forensic investigation]
(c) [Notification action, e.g. intimated affected Data Principals on DD-MM-YYYY]

5. ONGOING INVESTIGATION

This intimation is being made without delay upon becoming aware of the breach, consistent with Section 8(6). The investigation into the root cause, full scope, and impact is ongoing. A detailed follow-up report, including root cause analysis and remedial measures, will be furnished to the Board within the timeline prescribed under the DPDP Rules, 2025.

6. CONTACT FOR FURTHER INFORMATION

For any clarification or additional information the Board may require, please contact:
Name: [DPO Name]
Designation: [Designation]
Email: [Email]
Phone: [Phone]

We reaffirm our commitment to full cooperation with the Board in this matter and to strengthening our safeguards to prevent recurrence.

Yours faithfully,

[Authorized Signatory Name]
[Designation]
For [Organization Name]

Enclosures:
1. [Preliminary incident summary, if separately prepared]
2. [Copy of Data Principal notification, if already issued]