Consent Docs
Open console

Record a breach

Record a personal data breach, watch the 72-hour deadline for the report to the Data Protection Board, and copy the two drafts.

How-to3 min readFor privacy, marketing and support teams

Record a personal data breach as soon as you become aware of it. The register counts down to the report due to the Data Protection Board of India, and drafts the report and the notice.

The product reports nothing for you

It sends nothing to the Board and notifies no one. You do both, then record here when you did.

Record the breach#

  1. Open Audit.
  2. In the Breach register panel, choose Record a breach.
  3. Type a short Title, such as Exposed analytics export.
  4. Set Became aware to when your organisation first knew.
  5. Fill in Happened (if known) and People affected if you know them.
  6. Fill in what you know so far in the description fields.
  7. Choose Record breach.
The Record a breach panel with the title, the Became aware time and the description fields
The Record a breach panel with the title, the Became aware time and the description fields

Only the title and the time are required. Save with those, and add the rest as you learn more.

Watch the 72-hour clock#

The clock starts at Became aware, not when you save. Under Rule 7 of India's DPDP Rules, the full report to the Board is due 72 hours later. Each breach shows a badge:

Badge Meaning
48 h left to report The hours that remain. The badge changes colour at 12 hours or fewer.
Board report overdue The deadline has passed and no report date is recorded.
Reported to the Board You recorded when the full report was sent.
The Breach register panel on the Audit page with one breach and its hours left to report
The Breach register panel on the Audit page with one breach and its hours left to report

When 12 hours or fewer remain and no report date is recorded, your systems receive the breach.report_due webhook once.

If the Board allows a longer period

Open the breach and fill in Longer period the Board allowed on written request. When that date is later than the 72 hours, the deadline moves to it.

Copy the drafts and record what you sent#

  1. In the Breach register panel, click the breach to open it.
  2. Choose Copy notice for the notice to affected people.
  3. Choose Copy Board report for the report, as structured data.
  4. Read both drafts and replace any stand-in text, such as "details to follow".
  5. Send the notice and the report through your own channels.
  6. Fill in Board told (initial), People notified and How affected people were told.
  7. Fill in Board full report sent. This stops the countdown.
  8. Choose Save.

The drafts are built from what you entered, and they update each time you save. They are a starting point, not legal advice. The notice names the privacy contact from your project settings. If none is set, the draft has a marked gap for you to fill.

Check dates before you save

You can change a saved date to another date, but you cannot clear it. Check Board full report sent with care, because it ends the countdown. Breaches cannot be deleted.

Send the notice to your systems#

Your systems can receive the notice to pass on, instead of a copy. Before you start, subscribe an endpoint to breach.people_notice.

  1. Open the breach and fill in How affected people were told.
  2. Choose Send to your systems.

The event carries the notice, its SHA-256 and the breach. Your systems send it to each affected person. People notified is set to that moment if it was empty, and the method is recorded. Without an endpoint, nothing is sent and nothing is recorded.

↑↓ to move, Enter to open