Data Breach Notification Letter Generator

About the Data Breach Notification Letter Generator

When personal data is lost, stolen, exposed or locked away, the clock starts the moment you become aware of it. Enter the facts once — what happened, when, the data and the people involved, the likely consequences and what you are doing — and the generator writes every notice the laws you tick can require: the notification to the supervisory authority under GDPR Article 33, the plain-language notice to the people affected under Article 34, the report to the UK’s Information Commissioner, India’s intimations to the Data Protection Board and to each affected Data Principal under rule 7 of the DPDP Rules, a general notice for other countries — and the incident record that Article 33(5) asks you to keep, with a timeline of what was known when and the reasons for your decisions.

The checks flag what is missing before you send: the contact point, the reasons for a notification later than 72 hours, a high risk with no notice to the people affected, dates in the wrong order. The free preview shows every page as marked images, with your own facts and the first part of the wording readable; the DOCX, PDF, text file, copying and printing need a Premium pass. Nothing you type leaves your browser.

Common uses

• Privacy and security teams under the 72-hour clock, who need the authority notice and the customer letter at the same time.
• Small businesses and charities without an in-house lawyer, working from the incident facts.
• Organisations with customers in the EU, the UK and India, who must notify under several laws at once.
• Keeping the record of every breach — including those that need no notification — that Article 33(5) requires.

What the GDPR asks for

• The supervisory authority (Article 33): without undue delay and, where feasible, within 72 hours of becoming aware — unless the breach is unlikely to result in a risk to people. A later notification gives the reasons for the delay. It describes the nature of the breach with the categories and approximate numbers of people and of records, the contact point (the data protection officer), the likely consequences and the measures taken or proposed. Information you do not have yet can follow in phases (Article 33(4)).
• The people affected (Article 34): without undue delay when the breach is likely to result in a high risk, in clear and plain language, with the contact point, the likely consequences and the measures. It is not needed when the data was unintelligible to others (for example encrypted with a safe key), when later measures mean the high risk is no longer likely, or when individual notices would take disproportionate effort — then a public communication instead.
• The record (Article 33(5)): every breach, notified or not, with its facts, effects and remedial action.

You become aware when you are reasonably sure that a security incident has compromised personal data. A controller outside the EU, with no lead authority, notifies the authority of every Member State where affected people live (EDPB Guidelines 9/2022).

The UK GDPR and the ICO

The same rules apply under the UK GDPR, with the Information Commissioner’s Office as the authority. The ICO takes reports through its online form, within 72 hours where feasible, and asks organisations to report early and update later when the picture is still incomplete. The report this tool writes holds the answers the form asks for — what happened, when and how you found out, who is affected, what you are doing and who to contact — and stays with your record.

India: rule 7 of the DPDP Rules

Under section 8(6) of the DPDP Act and rule 7 of the DPDP Rules (applicable from 13 May 2027), every personal data breach — there is no “unlikely to result in a risk” exception — is intimated:

• to each affected Data Principal, without delay, through her user account or the contact she registered: what happened, with its nature, extent and timing; the consequences relevant to her; the measures taken; the safety measures she can take; and a business contact;
• to the Data Protection Board, without delay: the nature, extent, timing and location of the breach and its likely impact;
• to the Board again within 72 hours, or a longer period it allows on a written request: updated and detailed information, the facts and reasons that led to it, the measures to mitigate risk, findings about who caused it, the remedial measures against recurrence and a report on the intimations to Data Principals.

A data breach is also a cyber incident to report to CERT-In within six hours (CERT-In Directions, direction (ii) and Annexure I).

Other countries and US states

Many countries and US states have their own breach rules — who must be told, what the notice says and the deadline, often with a regulator or attorney general to inform as well. The general notice uses the headings most of them expect (what happened, what information was involved, what we are doing, what you can do, how to contact us): adapt it to the law of each place where affected people live.

Limitations

• A generic template, not legal advice. Whether a breach must be notified, and to whom, depends on the facts, your contracts and the law of every place affected people live — have a lawyer review the notices before you send them.
• It writes the notices; it does not send them or submit an authority’s online form.
• The 72 hours are counted on the clock you enter, without daylight-saving changes. For exact deadlines in any time zone, use the Breach Notification Deadline Calculator.
• Sector rules can add duties and shorter deadlines — NIS2, health, telecoms and financial regulators, CERT-In — and are not written here.

Privacy

Everything you type stays in your browser and is never uploaded or stored by MySmartCoPilot. If you tick Keep a draft in this browser, the form is saved in this browser’s local storage until you untick it — leave it off on a shared computer.