Personal Data Breach Response & Board Intimation

About this service

When personal data is leaked, stolen, lost or wrongly accessed, the DPDP Rules, 2025 require the Data Fiduciary to inform each affected person and the Data Protection Board of India without delay, and to file a detailed report with the Board within 72 hours of becoming aware of it. An advocate helps you record the facts, drafts the intimation to the Board and the notice to affected Data Principals, and advises on CERT-In reporting where it applies. Technical forensics are not included.

What you get

• Urgent consultation to record what happened
• Intimation and detailed report to the Data Protection Board of India
• Notice to affected Data Principals
• Advice on CERT-In reporting where applicable
• Checklist of steps to contain and document the breach

How it works

1. 1

   Call us

   An advocate takes down the facts on an urgent call.

2. 2

   Drafting

   Board intimation and the notice to affected people are drafted.

3. 3

   Filing

   You review and submit within the 72-hour window.

4. 4

   Follow-up

   Advice on documentation and any questions from the Board.

Documents you will need

• What happened, when it was discovered and which systems were involved
• Categories and approximate number of people affected
• Steps already taken to contain the breach
• Company details and the person responsible for data protection

Scans or clear photographs are fine. The lawyer handling your matter will tell you if anything else is needed once they have seen your papers.