Section 8(6)v1.3Live

Personal Data Breach Response Planner

Overall progress0%

0 of 22 actions completed

1. Detect & Contain

Immediate0/4

Confirm the incident is a personal data breach (unauthorised access, loss, or disclosure).Isolate affected systems to stop ongoing exposure.Preserve logs and forensic evidence before remediation.Activate the incident response team and assign an owner.

2. Assess Scope & Impact

First hours0/4

Identify which data categories and how many Data Principals are affected.Determine root cause (as far as currently known).Assess likely harm to affected individuals.Check whether any Data Processor is involved and pull them into the response.

3. Notify the Data Protection Board

Without delay0/3

Send initial intimation to the Board describing nature, extent and likely impact.Assign a reference/tracking number for this incident internally.Calendar the deadline for the detailed follow-up report.

4. Notify Affected Data Principals

Section 8(6)0/4

Draft a clear, plain-language notice of what happened and what data was involved.Explain what the organization is doing about it.Give practical steps the individual can take to protect themselves.Send via the same channel(s) used for the original notice, where possible.

5. Detailed Report & Remediation

Follow-up window0/3

Submit the detailed root-cause report to the Board.Document remedial and mitigating measures taken.Update Data Processor contracts or controls if the cause traces to a vendor.

6. Post-Incident Review

Within 30 days0/4

Run a blameless post-incident review.Update the risk register and security safeguards.Log this incident in your Compliance Evidence Tracker.Re-test the incident response plan against lessons learned.

Draft your Board intimation

Fill in what you know now — you can send the initial intimation before every detail is confirmed.

Details

Organization name

Date breach was discovered

Data categories affected

Approximate number of individuals affected

Known or suspected cause

Containment / remedial actions taken so far

Incident contact (name & email)

Live preview

PERSONAL DATA BREACH INTIMATION
To: Data Protection Board of India
From: [Organization Name]

DATE OF DISCOVERY: [discovery date]

1. NATURE OF THE BREACH
   [Organization Name] identified a personal data breach on [discovery date].

2. DATA CATEGORIES AFFECTED
   [data categories]

3. ESTIMATED SCOPE
   Approximately [approximate number] Data Principals are believed to be affected.

4. KNOWN OR SUSPECTED CAUSE
   [known/suspected cause]

5. IMMEDIATE ACTIONS TAKEN
   [containment actions taken]

6. NEXT STEPS
   A detailed root-cause report, including full remedial and mitigating
   measures, will follow in accordance with the timeline prescribed under
   the DPDP Rules, 2025. Affected Data Principals are being separately
   notified in clear language, in accordance with Section 8(6) of the
   DPDP Act, 2023.

7. CONTACT FOR THIS INCIDENT
   [incident contact]

---
Generated with the DPDP Navigator Breach Response Planner.
Have this reviewed by legal/compliance counsel before submission.