What do the BRSR Principle 9 complaint and data breach rows ask for?
Principle 9 of the Business Responsibility and Sustainability Report (BRSR) asks for consumer complaints in seven categories, received and pending, voluntary and forced product recalls, whether a cyber security and data privacy policy exists, and data breaches: the number, the share involving customers' personal information, and the impact.
Consumer complaints, the seven rows
- Data privacy.
- Advertising.
- Cyber-security.
- Delivery of essential services.
- Restrictive trade practices.
- Unfair trade practices.
- Other.
- Each row gives complaints received during the year, pending resolution at the end of the year, and a remark, for the current and previous financial year.
Product recalls on account of safety issues
Two rows, voluntary recalls and forced recalls, each with a number and the reasons for recall.
Cyber security policy and data breaches (Annexure II, essential indicator 7)
- Does the entity have a framework or policy on cyber security and risks related to data privacy? Yes or No, with a web-link if available.
- Number of instances of data breaches.
- Percentage of data breaches involving personally identifiable information of customers.
- Impact, if any, of the data breaches.
- Corrective actions taken or underway on advertising, delivery of essential services, cyber security and data privacy of customers, re-occurrence of instances of product recalls, and penalty or action by regulators on safety of products or services.
A formula the format does not print
The format asks for the percentage of data breaches involving personally identifiable information of customers, and prints no formula. Our reading is breaches involving customers' personal information divided by all data breaches, times 100. Say in a remark if you used a different base.
Example: data breach rows
- Instances of data breaches: 4. Of these, 1 involved personally identifiable information of customers
- Percentage involving customer information = 1 x 100 / 4 = 25.0%
The counts are an example.
What Senseible does here
Senseible reads fuel invoices and electricity bills into monthly records. It does not handle customer complaints or breach records, so these rows stay with your compliance team.
- BRSR Core: the nine attributes and KPIs
- BRSR fines and penalties disclosure
- BRSR and BRSR Core in plain words
Sources: SEBI, Updated BRSR format, Annexure II to circular of 12 July 2023, SEBI, master circular for LODR compliance, 11 July 2023, BRSR guidance note and formats
Last reviewed 2026-11-05. The guidance and formats are from SEBI's 11 July 2023 master circular and the Annexure II format. SEBI's April 2025 FAQ names a later master circular dated 11 November 2024, so check the current guidance note and format before you file.