Template · Breach letter
Breach notification to affected individuals
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
On becoming aware of a personal data breach, Rule 7(1) requires the Data Fiduciary to intimate each affected Data Principal without delay, in a concise, clear and plain manner, through their registered channel: what happened, the likely consequences, what has been done, what they can do to protect themselves, and who to contact.
Speed, then substance
Rule 7(1) says without delay. There is no waiting for the investigation to finish; the letter goes out with what is known, and a second one can follow. There is no harm threshold: every breach as defined in Section 2 is intimated. The Schedule assigns the Rs 200 crore band to failures under Section 8(6).
What a checklist misses
A checklist asks whether an incident response plan exists. The Act asks whether the affected person was told, in plain language, what they can do now. A letter that says "we take your privacy seriously" and nothing else fails Rule 7(1)(d).
What the letter must say
- 01What happenedThe nature, extent, timing and location of the breach, as known.Rule 7(1)(a)
- 02What it may mean for themThe likely consequences relevant to that person.Rule 7(1)(b)
- 03What you have doneThe measures implemented or proposed to mitigate the risk.Rule 7(1)(c)
- 04What they can doSafety measures the person may take to protect their interests.Rule 7(1)(d)
- 05Who to contactThe business contact of a person able to respond on the Fiduciary’s behalf.Rule 7(1)(e)
What Gevox generates
An unedited excerpt from a document Gevox produced for a fictional client from its intake answers: Rule 7(1) intimation to a Data Principal. Every client gets its own, built from its own answers, with each clause tied to the provision it satisfies.
Notice of a personal data breach affecting your personal data
Rule 7(1), Digital Personal Data Protection Rules 2025
We are writing to tell you about a personal data breach affecting personal data we hold about you. Rule 7(1) requires us to give you this intimation in concise, clear and plain language, and to include the five things set out below.
What happened
Rule 7(1)(a): a description of the breach, including its nature, extent and timing
An unsecured backup held by our payroll vendor was reachable from the public internet for nine hours.
Where it happened: A third party object store operated by the payroll vendor.
The categories of personal data involved are:
Name
Email address
Bank account number
40 Data Principals are presently understood to be affected.
That figure is arrived at as follows: Row count of the exposed table.
We became aware of this breach on 1 June 2027 at 12:00.
What this could mean for you
Risk of targeted phishing and of fraudulent payment instructions.
Rule 7(1)(b): the consequences relevant to you that are likely to arise from the breach
What we are doing about it
The bucket was made private and all vendor credentials were rotated.
We are also taking the following measures to prevent this happening again:
Quarterly access reviews written into the vendor contract.
Rule 7(1)(c): the measures implemented or being implemented by us to mitigate risk
What you can do to protect yourself
Do not act on payment instructions received by email without telephoning us first.
Rule 7(1)(d): the safety measures you may take to protect your interests
Excerpt. The full document continues.
01
Answer the intake
The client, or you for them, answers questions about their data, purposes and vendors.
02
Gevox drafts it
Fixed templates fill from those answers. The same answers always give the same document, and gaps are flagged, not guessed.
03
Hand it over
Export to Word or PDF. On Suite and Firm it carries your firm’s name.
Sample structure
Short, plain, sent through the channel the person registered with.
Subject
Important: a data security incident affecting your account
What happened
On 12 September a file containing names, email addresses and phone numbers of customers was sent to an unauthorised recipient. Your details were in it. No passwords or payment details were included.
What it may mean
You may receive unsolicited emails or calls. Treat any message claiming to be from us with care; we will never ask for a password.
What we have done
The recipient has confirmed deletion. We have restricted export permissions and reported the incident to the Data Protection Board of India.
What you can do
Be cautious of unexpected messages. If you notice anything unusual, contact us at the address below.
Contact
[Name], [email], [phone]. We will answer within two working days.
Questions people ask
- Do we tell people before we know everything?
- Yes. Rule 7(1) says without delay. Send what is known; follow up as the picture clears.
- Do we have to tell people if the data was encrypted?
- The Act has no encryption exception. A breach as defined in Section 2 is intimated; the letter can explain the protection in place.
- Which channel do we use?
- Rule 7(1) refers to the Data Principal’s user account or the mode of communication registered with the Fiduciary.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.