Lesson 5.5: Telling affected people: Rule 7(1)

Module 5 · Lesson 5.5 of 8 · About 30 minutes · Rule 7 1

The first duty after a breach is to the people harmed. This DPDPA 2023 course page explains rule 7 1 in plain language.

rule 7 1 - DPDPA 2023 course lesson banner

What you will learn about rule 7 1

Know what to tell individuals
Write a notice
Decide the channel

What to say (rule 7 1)

Inform each affected Data Principal without delay, in a concise, clear and plain manner, with: a description of the breach including its nature, extent and timing; likely consequences; measures taken and being taken to mitigate risk; safety measures the person can take; and business contact details to answer questions.

Notice to individuals

Select a numbered box to read more.

Tap or click a step to see exactly what to do.

Channel choice (rule 7 1)

Channel	Use when
Email	Primary, with a record
SMS	Urgent and short
In-app message	Active users
Letter	No digital contact

Worked example

Sample: We found on 2 March that an email list with your name and phone was accessed without permission. No passwords or payment details were involved. Please be careful with unknown calls. Contact privacy@company.example.

Activity (5 minutes) (rule 7 1)

Draft a template for an individual breach notice.

Key takeaway: Plain, honest and quick beats polished and late.

Check your understanding of rule 7 1

Q1. Individuals must be informed:

Q2. The notice should include:

Q3. The notice should be:

← What is a personal data breach Reporting to the Board: the 72-hour rule →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for rule 7 1: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.