When a breach hits, the DPDP Act requires you to tell affected Data Principals without delay. How you communicate decides whether you keep trust or lose it — and a good notice is also a compliant one.
What the notice must convey
Under Rule 7, tell affected people, in clear terms: what happened, the likely consequences, the measures you're taking, and what they can do to protect themselves. See breach notification for the full duties, including the 72-hour Board report.
Principles of a good breach notice
- Fast and honest — don't wait for perfect information to give an initial, accurate notice.
- Plain language — no jargon or minimising.
- Specific and useful — what data, what risk, what to do (reset passwords, watch statements).
- A channel for questions — and a real contact.
What not to do
Don't downplay, delay, or bury the notice. Vague 'an incident may have occurred' messaging erodes trust and can worsen your position with the Board.
Prepare templates now
Draft notice templates before an incident, so you can personalise and send fast rather than draft under pressure.
How DPDP Bridge helps
DPDP Bridge gives you ready breach-notice templates and a workflow to send them fast — compliant, clear and trust-preserving. Take the free assessment to see exactly where you stand and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.