Under the DPDP Act and Rule 7, if personal data is breached you must inform each affected individual and the Data Protection Board without delay, and give the Board detailed information within 72 hours of becoming aware. Preparing a simple incident plan now makes that far easier.
- Know who to call before something goes wrong.
- Contain first, then assess, then notify.
- Keep a record of what happened and what you did.
What counts as a breach
The Act defines a personal data breach as unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability. Everyday examples:
- a spreadsheet of student or patient details emailed to the wrong person
- a lost phone or laptop with unprotected records
- a compromised email or admin account
- a vendor system that exposes records online
What the law asks of you
As we read section 8(6) and Rule 7, a Data Fiduciary should:
- inform each affected individual without delay, in clear language, describing what happened, the likely consequences, what you are doing and what they can do to protect themselves
- inform the Data Protection Board without delay
- provide further detail to the Board within 72 hours of becoming aware, or a longer period the Board allows
Rule 6 also lists reasonable security safeguards, including access control, logging and monitoring, backups and clear contracts with processors, and Rule 8 asks for relevant logs to be kept for a period. Check both Rules for exact wording.
Does CERT-In also apply?
Separately from the DPDP Act, the CERT-In Directions of 28 April 2022, issued under the IT Act, ask many organisations to report specified cyber incidents to CERT-In within 6 hours of noticing them, and to keep certain logs. Which incidents are covered and who must report depends on the type of organisation and incident, so check the Directions or take advice. The two regimes run side by side: a single incident can trigger both a CERT-In report and a DPDP notification.
A first-72-hours checklist
| When | Action | Who |
|---|---|---|
| Hour 0 to 2 | Contain: remove access, change passwords, isolate the device or account | IT contact or owner |
| Hour 2 to 8 | Assess: what data, how many people, how it happened | Incident lead |
| Within 24 hours | Notify affected individuals in plain language and inform the Board | Incident lead, with advice |
| Within 72 hours | Send the Board a detailed report: nature, extent, timing, cause, mitigation | Incident lead |
| After | Fix the cause, update vendors, note what you will change | Owner |
Prepare now: a one-page incident plan
- Name an incident lead and a backup, with phone numbers.
- List where personal data lives and who administers each system.
- Write a short message template for affected individuals.
- Record vendor contacts who can help with logs and containment.
- Test the plan once a year with a simple tabletop exercise.
Common mistakes
- Waiting until you are “sure” before telling anyone
- Deleting evidence while fixing the problem
- Having no idea who has admin access to which system
- Forgetting that a vendor’s breach can still be your responsibility
Frequently asked questions
Do I have to report every small incident?
The Act talks about personal data breaches generally and does not set a minimum size. Treat any exposure of personal data seriously, record it, and take advice if you are unsure whether it needs reporting.
What if the breach happened at my vendor?
The Data Fiduciary remains responsible for the data it hands to a processor. Your contracts should require prompt notice from vendors so you can meet your own duties.
Sources
- MeitY: Digital Personal Data Protection Act, 2023
- MeitY: DPDP Rules, 2025 publication page
- Gazette: G.S.R. 846(E), DPDP Rules, 13 November 2025
- Trilegal: 2022 CERT-In directions on reporting cyber incidents
Reviewed 3 November 2026. This is general information, not legal advice. Dates and details can change, so check the official sources.