Data breach response helper

Pick the law that applies. The helper shows what it requires, works out the deadline from the time you became aware, and drafts the messages to the regulator and to affected people. India, Brazil, Singapore, Thailand, Saudi Arabia and Switzerland were checked against current sources on 12 November 2026; the EU, UK, California and UAE entries need confirming with counsel. Everything is built in your browser and nothing is stored or sent. A drafting aid, not legal advice.

Country / law

Tell the Board and each affected person without delay; detailed Board report within 72 hours. Applies to companies from about 13 May 2027.

Date and time the clock starts (you became aware of the breach)

Your company name

Contact person and email/phone for questions

What happened (nature of the breach)

Extent: what data, roughly how many people

When it happened (timing) and where (system/location)

Likely consequences for the affected people

What you have done and are doing to reduce the risk

What affected people should do to protect themselves

Draft message to each affected person

Subject: Notice of a personal data breach at [your company name]

We are writing to tell you about a breach that may affect your personal data.

What happened: [what happened (nature of the breach)]
Extent and timing: [extent: what data, roughly how many people]. [when it happened (timing) and where (system/location)]
What this could mean for you: [likely consequences for the affected people]
What we are doing: [what you have done and are doing to reduce the risk]
What you can do: [what affected people should do to protect themselves]

If you have questions, contact [contact person and email/phone for questions].

Draft report to the Board

To: the Data Protection Board of India
Subject: Notification of personal data breach, [your company name] (India (DPDP Rules 2025, Rule 7))

Part 1 (first notice): description of the breach.
Nature: [what happened (nature of the breach)]
Extent: [extent: what data, roughly how many people]
Timing and location: [when it happened (timing) and where (system/location)]
Likely impact: [likely consequences for the affected people]

Part 2 (detail, within the period the law allows; for India 72 hours or a longer period the Board allows in writing):
1. Updated and detailed information on the above.
2. Broad facts, events, circumstances and reasons leading to the breach: [to be completed]
3. Measures implemented or proposed to mitigate risk: [what you have done and are doing to reduce the risk]
4. Findings about the person who caused the breach: [to be completed]
5. Remedial measures to prevent recurrence: [to be completed]
6. Report on the intimations given to affected people: [attach copy of the message sent, with the date and how many people were reached]

Contact: [contact person and email/phone for questions]

Keep a record of what you sent and when. Check the Board's current reporting channel and forms before sending, and have counsel review the drafts.