Data privacy (DPDP Act, 2023) · Template
The second limb of s. 8(6) is the harder one to write. It goes to the people affected, and its purpose is to let them protect themselves — which means it has to be specific, plain and prompt. A notice that reads like a legal disclaimer fails the only test that matters: whether the reader knows what to do next.
Quick Statutory Answer
Do I have to notify every affected customer individually? Section 8(6) of the DPDP Act, 2023 requires intimation to each affected data principal. The prescribed form and manner sit in the rules made under the Act, so confirm the current requirement — but the obligation is framed around the affected individuals rather than a general public announcement.
The full text of this document as VidhiSar drafts it, with every blank shown in square brackets. Copy it or download it as a Word file and fill it in yourself — or answer a few questions and VidhiSar fills it in and prints a formatted PDF. Clauses that apply only in some cases are left out here; the drafting flow adds them when your answers call for them.
Date: [Date of This Notice]
Dear Valued Customer,
WHAT HAPPENED
We are writing to inform you of a data security incident affecting [Your Business Name] that we detected on [Date the Breach Was Detected]. We take the protection of your personal data seriously and are providing you with this notice in the interest of transparency.
WHAT INFORMATION WAS INVOLVED
Our investigation determined that the following categories of your personal data may have been affected: [Categories of Customer Data Affected].
WHAT WE ARE DOING
Upon discovering this incident, we immediately took steps to contain it and secure our systems. We are conducting a thorough investigation and have reported this incident to the Data Protection Board of India in accordance with the Digital Personal Data Protection Act, 2023.
WHAT YOU SHOULD DO
As a precaution, we recommend that you: [Protective Steps You Recommend to Customers]. Please remain vigilant against any suspicious communications purporting to be from us or referencing this incident.
CONTACT US
If you have any questions or concerns about this incident, please contact our support team at [Customer Support Contact Email] or our Grievance Officer at [Grievance Officer Email]. We sincerely apologise for any inconvenience this may cause and remain committed to protecting your personal data.
Yours sincerely, [Your Business Name]
What the law behind this document actually requires.
| Essential Clause | Legal Purpose & Protection | Governing Law / Benchmark |
|---|---|---|
| What happened, in plain language | Two or three sentences a non-specialist reader understands. Legal phrasing here defeats the purpose of the notice. | DPDP Act, 2023 — s. 8(6) |
| What data of theirs was involved | Specific to the recipient where possible. 'Some customer information' tells them nothing they can act on. | DPDP Act, 2023 — s. 8(10) |
| When it happened and when you found out | The detection gap will emerge eventually. Stating it is better than being asked about it. | DPDP Act, 2023 — ss. 11–13 |
| What you have done | Containment and remediation, concretely — so the reader can judge whether the exposure is ongoing. | DPDP Act, 2023 — s. 8(6) |
| What they should do | The operative part. Change a password, watch for specific fraud patterns, contact their bank. Be concrete. | DPDP Act, 2023 — s. 8(10) |
| A monitored contact channel | A route to a person who can answer follow-up questions, not a no-reply address. | DPDP Act, 2023 — ss. 11–13 |
| The grievance route | The DPDP framework gives data principals grievance redressal rights. Tell them how to use them. | DPDP Act, 2023 — s. 8(6) |
Section 8(6) of the DPDP Act, 2023 requires intimation to each affected data principal. The prescribed form and manner sit in the rules made under the Act, so confirm the current requirement — but the obligation is framed around the affected individuals rather than a general public announcement.
What happened, what categories of their data were involved, when it occurred and was detected, what you have done, what they should do to protect themselves, and how to reach someone who can answer questions. The test is whether a non-specialist reader finishes it knowing what action to take.
Waiting for full certainty is the most common and most costly error. The duty is triggered by the breach, and a first notice with what is known — updated as more emerges — serves the reader better than a complete notice sent late.
The duty is expressed by reference to affected data principals, not to a volume threshold. A small breach is a smaller notification exercise, not an exemption from one.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.