DPDP Act · Section 8(6) · Rule 7
DPDP Act breach notification: what to do and when
When a Data Fiduciary becomes aware of a personal data breach, the DPDP Rules require notification to each affected Data Principal without delay and an intimation to the Data Protection Board. A detailed report to the Board is due within 72 hours, unless the Board allows a longer period.
Important: The 72-hour period applies to the detailed information for the Board. The initial Board intimation and notices to affected people are required without delay.
01 · Understand the event
What is a personal data breach?
The Act defines a personal data breach as unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability.
A breach may involve an external attack, an internal mistake, a misdirected message, an exposed system or another event affecting personal data. The legal definition focuses on what happened to the data and whether its confidentiality, integrity or availability was compromised.
Section 8(6) requires a Data Fiduciary to notify the Board and each affected Data Principal in the form and manner prescribed by the Rules.
See the definition in section 2(u) and section 8(6) of the Act.
02 · Two notification routes
Notify affected people and the Board
Rule 7 sets different information and timing requirements for Data Principals and the Data Protection Board of India.
Without delay
Notify each person whose personal data was affected through their user account or a communication channel registered with the Data Fiduciary.
Initial intimation without delay
Provide an initial description of the breach, including its nature, extent, timing and location, and its likely impact.
Within 72 hours
Submit updated and detailed information within 72 hours of becoming aware of the breach, unless the Board allows a longer period following a written request.
The 72-hour requirement is for the detailed Board information in Rule 7(2)(b). Rule 7 separately says the initial Board intimation and affected-person notices must be made without delay.
03 · Communicate clearly
What a notice to affected people should explain
Rule 7 says the notice must be concise, clear and plain. To the best of the Data Fiduciary’s knowledge, it should include:
- A description of the breach, including its nature, extent and timing.
- Consequences relevant to the affected person that are likely to arise.
- Measures implemented or being implemented to mitigate risk.
- Safety measures the person may take to protect their interests.
- Business contact information for someone who can answer questions on behalf of the Data Fiduciary.
Use the communication channel required by the Rule and make the message understandable to the people receiving it. The notice should give practical information without speculation about facts that are not yet known.
Source: Rule 7(1) of the DPDP Rules, 2025.
04 · Report and update
What to provide to the Board
Initial intimation
Without delay, send a description that covers the breach’s nature, extent, timing and location, together with its likely impact.
Detailed information within 72 hours
Provide updated details, the broad facts and circumstances leading to the breach, mitigation measures, findings about the person who caused it if any, steps to prevent recurrence, and a report on notices sent to affected Data Principals.
A longer period may be allowed by the Board on a written request. Follow the current Board process and the prescribed form and manner when making a report.
05 · Prepare your response
A practical breach response sequence
The Act and Rules prescribe notification duties. The following sequence is a practical way to organise response work; it is not a substitute for the statutory requirements or a complete incident response standard.
- Escalate and contain: route the incident to the people responsible for security, privacy, legal and business decisions, and take steps to limit continuing exposure.
- Establish known facts: record when the organisation became aware, what data and systems may be involved, the affected groups, and what is still being investigated.
- Coordinate with processors: obtain relevant incident details from service providers and preserve records needed to investigate and respond.
- Prepare both notifications: assign owners for the initial Board intimation, the detailed report and affected-person notices, with timelines tracked from awareness.
- Update and retain the record: document decisions, notices, mitigation and remedial actions, and review what should change to reduce recurrence.
Other laws, regulator directions, contracts or sector requirements may also apply to an incident. Review those separately for your organisation.
06 · Phased commencement
When do the DPDP breach duties take effect?
Section 8(6) of the Act and Rule 7 are among the provisions scheduled to commence 18 months after publication of the commencement notification and Rules.
The scheduled commencement date for section 8(6) and Rule 7. The commencement schedule is phased, so other provisions may have different dates.
See the Act commencement notification and the MeitY Rules documents and corrigendum.
DPDPConsentKit breach register
Keep breach response work organised
DPDPConsentKit has a breach register product in its toolkit and is preparing it for public release soon. The product is intended to support teams as they organise breach response and notification work.