DPDP Breach Notification Software
From detection to notified, tracked and reported, inside the 72-hour window
Complynz Breach Notification is DPDP breach response software. Connect your security stack so incidents arrive with their detection source, fill in one incident record, and the platform drafts AI-written notices for the Data Protection Board under Rule 7 of the DPDP Rules, for affected Data Principals, and for vendors, partners, investors and others. One click sends them by email, SMS and WhatsApp, and you can track every recipient: delivered, opened, clicked, bounced or failed, with resend. Reports and analytics give you the evidence for the Board and for your own audit, within the 72-hour window the Rules set for the detailed report.
Last updated: . Published by Complynz.
Built for: CISOs, DPOs, legal and incident-response teams at Data Fiduciaries in India that need a ready, auditable way to notify the Board and affected people without writing every notice from scratch under pressure.
Key facts
| Detection | Security-stack integration: EDR, MDR, SIEM, SOC and cloud security sources |
|---|---|
| Audiences | Data Protection Board, customers, employees, partners and vendors, board, investors and auditors |
| Send | One click, by email, SMS and WhatsApp |
| Drafting | AI-driven templates filled from the incident, validated for Rule 7 |
| Tracking | Per-recipient status, opens, clicks, bounces and resend |
| Deadline | Detailed report to the Board within 72 hours |
Start from your security stack
Breaches start as an alert in a tool, not a form in a compliance system. Record the detection source with the incident, and the clock, severity and evidence start with the tool that raised it.
- Detection source by category: EDR, MDR, antivirus, SIEM, SOC, cloud security or manual discovery
- Specific tool recorded under each category, with your own tools added
- Incident record with reference, severity, incident and discovery dates
- Systems affected, attack vector, data types and measures taken
- Estimated number of Data Principals affected
- Flows into the same evidence trail as endpoint DLP incidents
AI-driven templates for seven audiences
Each audience needs a different notice. One incident record fills them all: a formal intimation to the Board, plain language for customers, internal guidance for employees, and tailored notes for partners, the board of directors, investors and auditors.
- Templates for the Data Protection Board, customers, employees, partners, directors, investors and auditors
- Filled from the incident record, so facts stay consistent
- AI improves tone and precision for each audience
- Rule 7 validation for the notice to the Board
- Edit before you send; copy or export to PDF
- Translated per recipient language where needed
One-click notification to the Board, principals, vendors and investors
When the facts are confirmed, notify. Add recipients, choose the audience and send. The platform records who was notified, in which language and through which channel.
- Data Protection Board, Data Principals, vendors and partners, and investors from one record
- Recipient lists added or imported, with language per recipient
- Email from your own domain, so notices are recognised
- Mark as sent for notices you deliver outside the platform
- Every send stamped into the audit trail
- A tracked, repeatable process instead of a scramble
WhatsApp and SMS workflows, with tracking per recipient
Email alone does not reach everyone. Short messages for SMS and WhatsApp carry the essentials and point to the full notice, and the tracking view shows who has it and who does not.
- SMS and WhatsApp messages with their own short text
- Placeholders for name, company, incident reference and DPO email
- Status per recipient: delivered, pending, bounced or failed
- Opens and clicks for email, delivery and read for WhatsApp
- Resend for failures, and corrections for wrong addresses
- Search and filter by recipient
Reports and analytics
After the notices go out, the Board and your auditors will ask what happened. Analytics show reach, engagement and failures by channel and by stakeholder, and everything exports.
- Engagement funnel: sent, delivered, opened, clicked
- Daily activity chart over the notification window
- Results by channel: email, SMS and WhatsApp
- Breakdown by stakeholder
- Alerts for notifications that did not reach the recipient
- Export for your breach report and records
How it works
From alert to notified
The 72-hour clock starts at discovery. Everything from triage to the Board report runs on one record.
Flowchart as text:
- Alert from EDR, SIEM, SOC or cloud security → Create the incident with its detection source
- Create the incident with its detection source → Contain and assess: data types, systems and people affected
- Contain and assess: data types, systems and people affected → Personal data breach?
- Personal data breach? → (No) Close with the assessment kept
- Personal data breach? → (Yes) Fill the incident record once
- Fill the incident record once → AI drafts notices for each audience
- AI drafts notices for each audience → Validate the Board notice for Rule 7
- Validate the Board notice for Rule 7 → Notify the Board, principals, vendors and investors
- Notify the Board, principals, vendors and investors → Detailed report to the Board within 72 hours
- Detailed report to the Board within 72 hours → Track, resend and report
One incident, seven notices
Each audience gets the same facts in the form it needs.
Flowchart as text:
- Incident record → Data Protection Board: formal intimation
- Incident record → Customers: plain-language notice
- Incident record → Employees: internal guidance
- Incident record → Partners and vendors: what to do next
- Incident record → Board of directors: briefing
- Incident record → Investors: disclosure
- Incident record → Auditors: evidence summary
- Data Protection Board: formal intimation → Tracked sends with an audit trail
- Customers: plain-language notice → Tracked sends with an audit trail
- Employees: internal guidance → Tracked sends with an audit trail
- Partners and vendors: what to do next → Tracked sends with an audit trail
- Board of directors: briefing → Tracked sends with an audit trail
- Investors: disclosure → Tracked sends with an audit trail
- Auditors: evidence summary → Tracked sends with an audit trail
Delivery tracking and resend
Every recipient is tracked by channel until the notice is delivered or corrected.
Flowchart as text:
- Notice sent by email, SMS and WhatsApp → Delivered?
- Delivered? → (Yes) Record delivered, opened or read
- Delivered? → (Bounced or failed) Show the failure reason
- Show the failure reason → Correct the address or number
- Correct the address or number → Resend only to that recipient
- Resend only to that recipient → Delivered?
- Record delivered, opened or read → Analytics by channel and stakeholder
- Analytics by channel and stakeholder → Export for the Board report and audit
How this maps to the DPDP Act
| Section | Subject | What you must be able to show |
|---|---|---|
| Section 8 | Breach intimation | A Data Fiduciary must intimate the Data Protection Board and each affected Data Principal of a personal data breach. Under the Rules, the detailed report to the Board is due within 72 hours. |
| Section 8 | Reasonable security safeguards | Detecting a breach quickly, from the security stack, is part of having safeguards that work. The incident record shows the detection source and measures taken. |
| Section 8 | Processors | A Fiduciary is accountable for its Data Processors, so vendors and partners are notified and tracked as part of the response. |
| Section 10 | Significant Data Fiduciaries | SDFs face audits and impact assessments where breach readiness and the evidence trail are examined. |
| Section 33 | Penalties | Failure to notify, and failure to keep reasonable safeguards, carry penalties set out in the Act's schedule. See the penalty schedule for current figures. |
How it fits with the other Complynz products
- Consent Management: Consent records give the contact details and language for notifying affected Data Principals.
- Data Discovery & DSPM: The data map shows what personal data sat in the affected systems, so the notice is accurate.
- Endpoint DLP: An endpoint incident can open a breach record with its evidence attached.
- Gap Assessment: Breach readiness is scored in the gap assessment and fixed through the roadmap.
- Third-Party Risk (TPRM): A vendor breach is tracked from the vendor register, and vendors are notified from the same record.
Frequently asked questions
What does the DPDP Act require when there is a personal data breach?
You must intimate the Data Protection Board and each affected Data Principal without delay, and send a detailed report to the Board within 72 hours, with remedial steps and evidence. There is no harm-threshold exemption, so every personal data breach needs a decision and a record.
What is Rule 7 of the DPDP Rules?
Rule 7 sets what a breach intimation must contain: the nature, extent and timing of the breach, its likely impact, the measures taken, advice for affected people and contact details for questions. The Board notice template is validated against these fields.
Which audiences can I notify?
Seven: the Data Protection Board, customers and other Data Principals, employees, partners and vendors, the board of directors, investors and auditors. Each has its own template filled from the same incident record.
Can it notify by WhatsApp and SMS as well as email?
Yes. SMS and WhatsApp have their own short messages with placeholders for name, company, incident reference and DPO email, and the tracking view shows delivery and read status next to email.
How does it connect to our security tools?
An incident records its detection source by category (EDR, MDR, antivirus, SIEM, SOC, cloud security or manual) and the specific tool, so the breach record starts from the alert that raised it.
How are the notices written?
Templates are drafted from the incident record, then AI improves tone and precision for each audience. You review and edit before anything is sent, and the Board notice is validated for Rule 7.
How do I know the notices were received?
Each recipient has a status: delivered, pending, bounced or failed, with opens and clicks for email and delivery and read for WhatsApp. Failures show a reason, and you can correct the address and resend only to that person.
What reports can I give the Board and auditors?
Analytics show an engagement funnel, daily activity, results by channel and a breakdown by stakeholder, and everything exports. Together with the incident record, they form the evidence of what was done and when.
What are the penalties for not notifying a breach?
The Act sets penalties in its schedule for failing to notify and for failing to keep reasonable safeguards. The figures are on the penalty schedule page, which we keep in step with the Act.