Breach response
Every breach goes to the Board and to each person affected.
The DPDP Act has no harm threshold for reporting. If personal data is breached, the Data Protection Board of India (the Board) and every affected person are told. The Rules fix what each notice says and when the fuller report to the Board is due.
Back to DPDP services01 · What counts
A breach is wider than a hack
Anything that hurts confidentiality, integrity or availability of personal data.
The Act's definition covers unauthorised processing and any accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access that compromises the data. Intent does not matter, and neither does whether anyone outside saw it.
- Ransomware that locks a customer database, even if nothing is copied out
- A spreadsheet of patient names sent to the wrong email address
- A storage bucket left open to the internet
- An employee browsing records they have no reason to see
- A faulty script that overwrites account details
A processor's incident is your breach to report if the data is yours. Your contract must make the processor tell you fast enough to meet your own duties.
02 · Who is told
Two audiences, two notices
The person needs to protect herself. The Board needs to judge your response.
Each affected person
Without delay, in plain words
- Through her user account or a contact channel she registered with you
- Concise and clear, to the best of your knowledge at the time
- Sent to every affected person, not a sample
The Board
Twice: a first notice, then a full report
- A first description without delay
- Detailed information within seventy-two hours of becoming aware
- The Board may allow longer on a written request
Rule 7 is in the group that starts eighteen months after publication. Once a breach is intimated, the Board can direct urgent remedial or mitigation steps and open an inquiry.
03 · What they say
What each intimation contains
The Rules list the minimum. Draft templates now, with gaps to fill.
| Item | To the affected person | To the Board |
|---|---|---|
| What happened | Nature, extent and timing of the breach | Nature, extent, timing, location and likely impact; then updated detail |
| Why it happened | Not required | The broad facts, circumstances and reasons behind it |
| Consequences | Those relevant to her that are likely to follow | Covered by likely impact |
| What you are doing | Measures taken and under way to reduce risk | Mitigation taken or proposed, and remedial steps against recurrence |
| What she can do | Safety steps she can take herself | Not required |
| Who caused it | Not required | Any findings about the person responsible |
| Contact | A person who can answer her questions | A report on the intimations sent to affected people |
04 · Playbook
A response playbook with owners and records
Each step leaves a record the Board can ask to see.
| Step | Owner | Record kept |
|---|---|---|
| Detect and log the event | Security operations | Alert, first-seen time, who raised it |
| Confirm personal data is involved | Incident lead with privacy | Decision note with the time of becoming aware |
| Contain and preserve evidence | Engineering and security | Actions taken, logs and images preserved |
| First notice to the Board | Privacy lead or DPO | Copy of the intimation and time sent |
| Check other reporting duties | Legal and security | Note of CERT-In, regulator and contract notices assessed and sent |
| Identify affected people | Data and engineering | List of affected people and data categories |
| Notify each affected person | Privacy with communications | Message text, channel, send log per person |
| Detailed report to the Board | Privacy lead or DPO | Report, or the written extension request and reply |
| Root cause and fixes | Engineering | Root-cause note, remediation tickets, closure evidence |
| Review and drill | Privacy and security | Lessons log; date of the next breach drill |
05 · CERT-In
How this sits beside CERT-In reporting
Two regimes, two recipients, often the same incident.
The Indian Computer Emergency Response Team (CERT-In) collects reports of cyber security incidents under the IT Act. Its directions cover incidents whether or not personal data is involved, and they run on their own clock. A breach of personal data caused by a cyber incident will usually trigger both duties. Neither notice replaces the other.
CERT-In's reporting window is commonly cited as much shorter than the Board's detailed-report deadline. Build the CERT-In check into the first hour of the playbook, and confirm the current directions with counsel.
Sector regulators such as the RBI, SEBI and IRDAI may expect their own incident reports, and customer contracts often add a notice clause of their own. Map all of them once, so the incident lead is not reading regulations at two in the morning.
06 · Records
Records to keep before and after
The Rules ask for logs; your defence needs the rest.
- Access logs for a year. Rule 6 expects logs and monitoring that let you detect and investigate misuse, kept for one year unless another law asks more.
- Processor clause. Contracts with processors that require reasonable safeguards and prompt breach notice to you.
- Breach register. Every event assessed, including the ones you decided were not personal data breaches, with reasons.
- Copies of intimations. Board notices, person-level send logs and any extension correspondence.
- Templates. Pre-drafted notices for the Board and for people, reviewed by counsel.
Sources: the Digital Personal Data Protection Act, 2023 (sections 2, 8 and 27, and the Schedule) and the Digital Personal Data Protection Rules, 2025 (rules 1, 6 and 7), as published by the Ministry of Electronics and Information Technology. CERT-In directions are named for reference only.
Questions about breach reporting
Do we report a breach that is unlikely to cause harm?
Yes. The Act sets no risk threshold.
The duty applies to any personal data breach. Harm and likely impact shape what you say, not whether you say it.
How long do we have to report to the Board?
A first notice without delay; the detailed report within 72 hours.
Rule 7 asks for a description without delay, then fuller detail within seventy-two hours of becoming aware, unless the Board allows longer on a written request. Record the moment you became aware, since the clock runs from it.
Our vendor had the breach. Who reports?
You do, as the data fiduciary.
The fiduciary stays responsible for processing done on its behalf. Your processor contract should require the vendor to tell you quickly and give you what you need to report.
Does reporting to CERT-In cover the Board?
No. They are separate duties.
CERT-In reporting comes from the IT Act and its directions; Board intimation comes from the DPDP Act. One incident can trigger both, each with its own content and timing.
What is the penalty for not reporting?
A ceiling of up to ₹200 crore.
The Schedule caps the penalty for failing to give the Board or affected people notice at up to ₹200 crore. Weak security behind the breach is a separate item with a higher ceiling.
Rehearse the breach before it happens.
A DPDP readiness assessment writes your playbook and templates and runs a breach drill against the Board's timeline. Counsel should confirm how the law applies to your contracts.