Claude Code
❯ We had a database exposure for Acme Retail, our India client. Does this need to be reported, and by when?
⏺ Checking your licence on this machine and reading the breach-notification pack for Acme Retail's jurisdiction (India)…
✓ Licence valid — vDPO Advisor, licensed to your account. Working offline: nothing leaves this machine.
✓ Read the Breach pack for India from your package — Digital Personal Data Protection Act 2023, DPDP Rules 2025, CERT-In Directions 2022. Last reviewed 12 Aug 2026.
⏺ Answer: Yes. A personal data breach must be notified to the Data Protection Board of India, and in most cases to affected Data Principals. (DPDP Act, s. 8(6))
⏺ Deadline: Notify the Board without delay once the breach is known; CERT-In requires certain incidents to be reported within 6 hours of noticing. Clock starts on discovery, not confirmation. (CERT-In Directions 2022, Direction (ii))
⏺ Drafting a regulator-notice template and an individual-notice template for Acme Retail, citations included…
✓ Done. Two drafts ready for your review — nothing was sent, and no client data left your machine.