====================================================================
STARTING TEMPLATE from dpdprules.org
Personal data breach intimation to affected Data Principals

Practical recommendation, not legal advice. Have your legal counsel
review and adapt this before use. Bracketed text marks what you must
fill in.

Provisions tracked: Rule 7(1) of the DPDP Rules 2025 (intimation to
each affected Data Principal) and section 8(6) of the DPDP Act 2023.
These sit in the commencement group due eighteen months from the
publication gazette; the computed date 13 May 2027 is interpretation
until officially confirmed. Verified source references:
https://dpdprules.org/rules/7 and https://dpdprules.org/act/8
====================================================================

Send through the person's user account or a registered mode of
communication, without delay after becoming aware of the breach.
Write in a concise, clear and plain manner.

--------------------------------------------------------------------

Subject: Important information about your personal data

Dear [name],

We are writing to tell you about a personal data breach at
[organisation name] that affects you.

What happened
[Describe the breach: its nature, extent and the timing of its
occurrence, to the best of your knowledge.]

What this may mean for you
[Describe the consequences likely to arise for this person from the
breach, relevant to them: for example misuse of contact details,
risk of phishing attempts, or exposure of account information.]

What we are doing
[Describe the measures implemented and being implemented to
mitigate risk arising from the breach.]

What you can do to protect yourself
[Describe the safety measures the person can take: for example
changing the account password, watching for suspicious messages, or
enabling additional login verification.]

Questions
[Business contact information of a person able to respond to
queries on behalf of the organisation: name or role, channel and
hours.]

We are sorry this happened. We will share further updates if the
facts change materially.

[Organisation name]

--------------------------------------------------------------------
Checklist before sending
--------------------------------------------------------------------

1. Sent without delay on becoming aware of the breach; the rule has
   no materiality threshold and covers every affected person.
2. Concise, clear and plain language; no jargon.
3. All five content elements above are present.
4. Sent through the user account or a registered communication mode.
5. A copy is kept for the report to the Data Protection Board on the
   intimations given to affected Data Principals.