Breach notification

1. We record the incident in our incident register as soon as we become aware of it, assess it and act to contain it.
2. Without delay, we tell the Data Protection Board of India and every person affected.
3. Within 72 hours of becoming aware of it (or longer, if the Board allows), we give the Board a detailed report: the facts, the cause, what we did to reduce harm, and how we told the people affected.
4. Where the incident is reportable under the CERT-In Directions (IT Act section 70B), we also report it to CERT-In within the time those Directions set.

We will tell you in clear and plain language:

• what happened, when, and how serious it is;
• what it may mean for you;
• what we have done and are doing to reduce harm;
• what you can do to protect yourself; and
• how to contact us about it.

We will reach you by a notice inside your JeevanPatra account and, where available, by SMS or email to your registered contact details.

If you believe your data or account has been exposed, contact our privacy contact through the grievance page. See security practices for how we protect data.