Template · Board report
Breach report to the Data Protection Board
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
Rule 7(2) requires two things to the Board: an intimation on becoming aware of the breach, without delay, and within seventy-two hours, or a longer period only if the Board allows on a written request, a detailed report with the findings, the remedial measures, the person responsible, and confirmation of what affected individuals were told.
Two submissions, one clock
The first goes at once: a description of the breach with its nature, extent, timing and location, and the likely impact. The second, inside seventy-two hours of becoming aware, is the full report. Both go through the Board’s digital platform. Missing the clock is a Section 8(6) failure in the Rs 200 crore band.
What a checklist misses
A checklist asks whether the incident was logged. The Act asks whether the Board was told within seventy-two hours with the specific contents Rule 7(2) lists, including who the intimation to individuals went to and when.
What the report must contain
- 01Updated descriptionThe nature, extent, timing and location of the breach, updated from the first intimation, and the likely impact.Rule 7(2)(a), 7(2)(b)(i)
- 02Facts and causesThe broad facts, the circumstances, and the reasons that led to the breach.Rule 7(2)(b)(ii)
- 03MitigationThe measures implemented or proposed to mitigate risk.Rule 7(2)(b)(iii)
- 04The personFindings about the person who caused the breach, if any.Rule 7(2)(b)(iv)
- 05Remedial measuresThe measures taken to prevent recurrence.Rule 7(2)(b)(v)
- 06Intimations madeA report on the intimations given to affected Data Principals.Rule 7(2)(b)(vi)
What Gevox generates
An unedited excerpt from a document Gevox produced for a fictional client from its intake answers: Rule 7(2)(b) detailed report to the Board. Every client gets its own, built from its own answers, with each clause tied to the provision it satisfies.
Detailed report of a personal data breach
Rule 7(2)(b), Digital Personal Data Protection Rules 2025
IncidentPayroll vendor backup exposure
Became aware1 June 2027 at 12:00
This report3 June 2027 at 12:00
Hours from awareness to this report48
(i) Updated and detailed information
An unsecured backup held by our payroll vendor was reachable from the public internet for nine hours.
Location at which the breach occurred: A third party object store operated by the payroll vendor.
The categories of personal data involved are:
Name
Email address
Bank account number
40 Data Principals are presently understood to be affected.
That figure is arrived at as follows: Row count of the exposed table.
Likely impact, as presently assessed:
Risk of targeted phishing and of fraudulent payment instructions.
(ii) Broad facts: the events, circumstances and reasons leading to the breach
A configuration change on 31 May removed the access policy from the storage bucket.
Excerpt. The full document continues.
01
Answer the intake
The client, or you for them, answers questions about their data, purposes and vendors.
02
Gevox drafts it
Fixed templates fill from those answers. The same answers always give the same document, and gaps are flagged, not guessed.
03
Hand it over
Export to Word or PDF. On Suite and Firm it carries your firm’s name.
Sample structure
The headings the report walks through, in the order the Rule lists them.
1. Breach
Date and time of occurrence; date and time we became aware; systems and locations affected; categories and volume of personal data; number of Data Principals affected.
2. Facts and cause
What happened, in sequence. The failure that allowed it. Evidence retained.
3. Impact
Likely consequences for affected Data Principals, by category.
4. Mitigation and remediation
Steps taken within the first hours; controls changed; verification performed.
5. Person responsible
Findings, if identified; action taken.
6. Intimations
Date, channel and content of notices to affected Data Principals; number reached; contact provided.
Questions people ask
- When does the seventy-two hours start?
- On becoming aware of the breach, under Rule 7(2).
- Can we get more time?
- Only if the Board allows it on a written request, under Rule 7(2). Do not assume it.
- Does a processor’s breach count as ours?
- Yes. Section 8(1) keeps the Fiduciary responsible, and Section 8(6) requires the Fiduciary to intimate. The DPA should oblige the processor to tell you fast enough.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.