Tool · Free · No sign-up
Was I told about a breach correctly?
Check the breach notice you received against what the law says it must contain, and see what to do if something is missing.
What we found
Choose the law that covers you, then tick what your notice includes.
What each law requires
Each law's own text, as cited. The DPDP duty applies from 13 May 2027.
| Law | A notice must contain | When | Status |
|---|---|---|---|
| India (DPDP Act) | A description of the breach: what happened, how far it went, and when; The consequences likely for you; What the company has done, and is doing, to reduce the risk; What you can do to protect yourself; Contact details of someone who can answer your questions | Without delay, in a concise, clear and plain way, through your user account or a contact you registered with the company. Every affected person must be told; there is no risk threshold.s. 8(6); Rule 7(1) | Upcoming · 13 May 2027 |
| The EU or EEA (GDPR) | The nature of the breach, in clear and plain language; The name and contact details of the data protection officer or another contact point; The likely consequences of the breach; The measures taken or proposed to deal with it, including to reduce its possible harm | Without undue delay, when the breach is likely to put your rights and freedoms at high risk. The company need not tell you if the data was protected, for example by encryption, if it has since removed the high risk, or if telling everyone would take disproportionate effort, in which case it must make a public announcement instead.Art. 34(1) and (3) GDPR | In force |
| California (Civil Code 1798.82) | The title "Notice of Data Breach", in plain language; The headings What Happened, What Information Was Involved, What We Are Doing, What You Can Do, and For More Information; The business's name and contact information; A list of the types of personal information involved; The date, estimated date or date range of the breach, if known, and the date of the notice; Whether notice was delayed by a law enforcement investigation, if known; A general description of the breach, if known; The toll-free numbers and addresses of the major credit reporting agencies | In the most expedient time possible and without unreasonable delay.Civ. Code 1798.82(a) | In force |
Sources: DPDP Act 2023, s. 8(6); DPDP Rules 2025, Rule 7(1); Regulation (EU) 2016/679 (GDPR), Art. 33 and 34; California Civil Code 1798.82
This page explains the law in plain English. It is not legal advice.