Personal data incidents
Last updated: 18 September 2026
Report a concern
If you believe personal data held by HCI Talks may have been accessed, disclosed, changed or lost without authorisation, contact our existing privacy contact at [email protected]. Use the subject “Possible personal data incident”.
Include the affected page or service, when you noticed the issue, a brief description and a way to contact you. Do not send passwords, access tokens, identity documents or copies of other people’s personal data. Do not access additional data to investigate.
Assessment and response
A report starts an assessment; it does not by itself confirm a personal data breach. The response process is to assess the affected information and people, contain unauthorised access, preserve relevant evidence, and determine the notifications and corrective action required under applicable law. A service outage or other security incident is not automatically a reportable personal data breach.
Where notification is required, communications should explain what happened, the likely consequences, measures taken or underway, steps affected people can take, and a contact for assistance. Investigation findings may develop over time.
DPDP notification readiness
The final Digital Personal Data Protection Rules, 2025 distinguish between informing affected people and reporting to the Data Protection Board. When these duties apply, affected people and the Board must be informed without delay. Updated details must be provided to the Board within 72 hours of becoming aware of the breach, or within a longer period allowed by the Board on a written request.
These statutory duties apply from their notified effective dates and as applicable. The November 2025 notifications provide an eighteen-month commencement period for the relevant Act provisions and Rule 7; that period has not elapsed as of this page’s update date. Other applicable incident-reporting obligations remain separate. This page does not create an unconditional 72-hour response or resolution promise.
See the official DPDP Rules, 2025 (Rules 1 and 7) and Act commencement notification. This information is not a legal certification or a guarantee that an incident cannot occur.
Your privacy rights
For access, correction, withdrawal or deletion requests, follow the contact process in our Privacy Policy. Keep an enquiry receipt if you have one; it helps identify the relevant record.