# DPDP breach notification: two notices and a 72-hour report Source: https://dpdp.d2c.in/guides/dpdp-breach-notification/ · Updated 2026-11-13 · DPDP Ready by Mirav Labs **Short answer:** Under section 8(6) of the DPDP Act and Rule 7, from 13 May 2027 you must report every personal data breach, with no materiality threshold. Tell the Data Protection Board and each affected person without delay, then file a detailed report with the Board within 72 hours of becoming aware. Failing to notify can attract a penalty of up to ₹200 crore. ## Key takeaways - Every personal data breach is reportable under section 8(6); there is no risk or size threshold. - Two notices go out without delay: one to the Board, one to each affected Data Principal. - A detailed report to the Board is due within 72 hours of becoming aware, unless the Board allows longer on written request. - CERT-In's six-hour reporting for cyber incidents continues to apply in parallel. - Write processor-to-fiduciary breach notice into every contract, and rehearse with a tabletop drill. Most Indian companies already have some incident process, often built around CERT-In reporting. The DPDP Rules add two new audiences and a fixed deadline. From 13 May 2027, a personal data breach means a notice to the Data Protection Board, a notice to every affected person, and a detailed report to the Board within 72 hours, alongside whatever you owe CERT-In. This guide explains what triggers the duty, exactly what each notice must contain, how processors fit, and how to build and rehearse a runbook that meets the clock. ## What counts as a personal data breach under DPDP? Section 2(u) of the Act defines a personal data breach as any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability. That covers far more than a hack: - An invoice with customer details emailed to the wrong client (disclosure). - A storage bucket left open to the internet (unauthorised access). - An employee looking up records with no work reason (unauthorised processing). - Ransomware that locks a patient database, even if nothing leaves the network (loss of access, availability). - A faulty script that overwrites customer addresses (alteration, integrity). - A lost, unencrypted laptop with an HR export on it. Section 8(6) requires you to intimate **every** personal data breach to the Board and to each affected Data Principal. There is no materiality or risk-of-harm threshold, so a small misdirected email is reportable just like a large leak. Teams used to reporting only incidents above a risk threshold should expect to file many more reports than before. ## What is the timeline for DPDP breach notification? The clock starts when you become aware of the breach. Rule 7 then sets three deliverables. “Without delay” has no fixed number of hours in the Rules. Treat it as the time needed to confirm the facts you can state with reasonable confidence, not the time needed to finish the investigation. Rule 7 expects updates: the 72-hour report is where detail and findings go. ## What must each breach notice contain? Rule 7 is specific about content. Build your templates around this table so nothing is missed under pressure. | Notice | Timing | Must include | Rule | |---|---|---|---| | To each affected Data Principal | Without delay, to the best of your knowledge, through her user account or a registered mode of communication | (a) description of the breach: nature, extent, timing; (b) consequences likely to arise for her; (c) mitigation measures implemented or being implemented; (d) safety measures she can take; (e) business contact of a person who can answer her questions | Rule 7(1) | | Initial intimation to the Board | Without delay | Description of the breach: nature, extent, timing and location of occurrence, and the likely impact | Rule 7(2)(a) | | Detailed report to the Board | Within 72 hours of becoming aware, or longer if the Board allows on written request | (i) updated, detailed information on the description; (ii) broad facts, circumstances and reasons leading to the breach; (iii) mitigation implemented or proposed; (iv) findings about the person who caused it; (v) remedial measures to prevent recurrence; (vi) a report on the intimations given to affected people | Rule 7(2)(b) | The notice to people must be concise, clear and plain. Write it at the reading level of a customer message, not a legal letter, and offer it in the language the person uses with you. Item (d) matters most to the reader: tell them what to do, such as changing a password, watching for calls that pretend to be from you, or contacting their bank. Prepare item (vi) as you goThe 72-hour report must include a report on the intimations you gave to affected people. Log each notice as it goes out: channel, time, template version and delivery status. You cannot rebuild that list reliably at hour 70. ### How does the 72-hour report to the Board work? Rule 7(2)(b) gives you 72 hours from becoming aware to send updated and detailed information. If the investigation needs more time, you can ask the Board in writing for a longer period; the Rule allows it only if the Board permits. Ask early, with reasons, rather than at hour 71. Two practical points on the 72 hours: - **Define “aware” in your policy.** A workable definition: awareness is the point when a responsible person has a reasonable degree of certainty that a breach affecting personal data has occurred. Record that time in the incident log; everything runs from it. - **Know the channel.** The Board is established but, as of November 2026, its Chairperson and Members have not been appointed. Before 13 May 2027, confirm the Board's published channel for intimations and test that your team can reach it. ## Do you still report to CERT-In? Yes. CERT-In's direction of April 2022 requires reportable cyber incidents to be reported within six hours, and it continues to apply in parallel with Rule 7. A single incident can trigger both, and they ask different questions. DPDP Rule 7 - Trigger: any personal data breach - To: the Data Protection Board and each affected person - Timing: without delay, then the detailed report within 72 hours - Focus: impact on people, mitigation, notices sent - Penalty for failure: up to ₹200 crore CERT-In direction (April 2022) - Trigger: reportable cyber incidents, with or without personal data - To: CERT-In - Timing: within six hours - Focus: the cyber incident and its technical details - Runs in parallel; one does not replace the other Run both from one incident record so the facts you report are consistent. A breach that is not a cyber incident, such as a misdirected email, goes to the Board and the person but may not touch CERT-In at all. ## How should processors notify you? The Rule 7 duty sits with the Data Fiduciary. Section 8(1) keeps you responsible for processing done on your behalf by a processor, whatever your contract says. If your cloud host, payroll vendor or support desk tool has a breach, you have to notify, and your clock may already be running when they tell you. Every processor contract should therefore include: - Notice to you of any personal data breach within a fixed number of hours of their awareness, short enough to leave you room inside your own deadlines. - The facts Rule 7 needs, in a format you specify: what happened, when, where, which data, how many people, what they have done so far. - Ongoing cooperation, log access and named contacts until the incident is closed. - No notification to your customers or the Board on your behalf unless you agree. If you are the processor, expect your customers to ask for these terms. Our [fiduciary vs processor guide](https://dpdp.d2c.in/guides/data-fiduciary-vs-data-processor/) explains which role you hold, and the [security safeguards guide](https://dpdp.d2c.in/guides/dpdp-security-safeguards/) covers the rest of the processor contract. ## What should a DPDP breach runbook include? A runbook turns the Rules into tasks with owners. A workable outline: - **Intake.** One channel for staff, processors and the public to report suspected incidents, monitored at all hours. - **Triage.** Is personal data involved? If yes, it is a DPDP breach. Record the awareness time. - **Contain.** Stop the leak, revoke access, isolate systems, preserve logs (your Rule 6 one-year logs are your evidence). - **Scope.** Which data items, which people, which systems and processors. Pull contact routes for affected people. - **Notify.** Initial Board intimation and notices to people without delay; CERT-In within six hours where it applies. - **Investigate.** Cause, the person responsible if identified, and the remediation plan. - **Report.** The 72-hour Rule 7(2)(b) report, or a written request for more time. - **Close.** Remedial measures done, lessons logged, templates and controls updated. Pre-approve the templates for the notices with your counsel, in every language you support, so that on the day you are filling in facts, not drafting. Include legal, security, engineering, customer support and communications in the room, and at least one key processor if you can. Time each step against the 72-hour clock. ## What is the penalty for failing to notify a breach? Under the Schedule to the Act, failing to give the Board or affected people intimation of a personal data breach under section 8(6) can attract a penalty of up to ₹200 crore. If the breach happened because reasonable security safeguards were missing, that is a separate item with a ceiling of ₹250 crore. Whether the Board can add amounts across several breaches in one case is not settled; the Schedule sets a ceiling per breach and the Board decides. Section 33(2) lists the factors the Board weighs, including the gravity and duration of the breach, the type of data, and whether you took mitigation steps and how quickly. A prompt, complete notification with clear mitigation is itself part of your defence. The [penalties guide](https://dpdp.d2c.in/guides/dpdp-act-penalties/) has the full Schedule. ## What to do next - Update your incident policy to define a personal data breach using section 2(u) and to record awareness time. - Build the three Rule 7 templates (Board initial, Board 72-hour, Data Principal) and get them approved. - Map how you would reach affected people: user accounts, registered email and phone, by product. - Add breach notice clauses to every processor contract. - Align the DPDP and CERT-In reporting steps in one runbook. - Run a tabletop drill before 13 May 2027, and again every six months. Breach readiness is one line in the [DPDP compliance checklist](https://dpdp.d2c.in/guides/dpdp-compliance-checklist/) and a fixed step in the [implementation roadmap](https://dpdp.d2c.in/guides/dpdp-implementation-roadmap/). If you want us to write the runbook with your team and facilitate the first drill, [contact us](https://dpdp.d2c.in/#contact). ## Frequently asked questions ### Is there a 72-hour breach notification under DPDP? Yes. Rule 7(2)(b) requires a detailed report to the Data Protection Board within 72 hours of becoming aware of a personal data breach, or a longer period if the Board allows it on a written request. A shorter intimation to the Board, and notices to affected people, must go out without delay before that. ### Do all data breaches need to be reported under the DPDP Act? Yes. Section 8(6) requires you to intimate every personal data breach to the Board and to each affected Data Principal. There is no exception for breaches that look minor or unlikely to cause harm. ### Do I still need to report to CERT-In if I notify the Data Protection Board? Yes, where the incident is a reportable cyber incident. CERT-In's April 2022 direction, with its six-hour reporting window, continues to apply alongside the DPDP Rules. Plan for both reports from the same incident record. ### What is the penalty for not reporting a data breach in India? Under the Schedule to the DPDP Act, failing to give the Board or affected people intimation of a personal data breach can attract a penalty of up to ₹200 crore. A failure of security safeguards behind the breach is a separate item with a ceiling of ₹250 crore. ### Who reports a breach at a data processor? The Data Fiduciary. Section 8(1) keeps the fiduciary responsible for processing done by its processors, and the Rule 7 duty sits with the fiduciary. Your contracts should require processors to tell you promptly so that you can meet your own deadlines. ### What is a personal data breach under DPDP? Section 2(u) defines it as any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability. A misdirected email and a ransomware lock-out both qualify.