DPDP Breach Notification: Two Clocks, Two Regulators, 72 Hours

Most Indian companies have a plan for keeping attackers out. Far fewer have a plan for the first three days after one gets in. Under the Digital Personal Data Protection Act, 2023, those three days are regulated. DPDP breach notification means telling the Data Protection Board and every affected person, and the detailed report to the Board is due within seventy-two hours.

The duty applies from 13 May 2027. It will sit beside a rule that already applies today: CERT-In's direction to report cyber incidents within six hours. This guide explains what Section 8 of the Act and Rules 6 and 7 of the DPDP Rules, 2025 require, and what to prepare now.

What counts as a personal data breach?

Section 2(u) of the DPDP Act defines a personal data breach as "any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data".

• It is not limited to attacks. A customer file emailed to the wrong list is an accidental disclosure.
• Loss of access counts. Ransomware that locks records can compromise availability even if nothing is published.
• Your vendor's breach is your breach. Section 8(1) keeps the Data Fiduciary responsible for processing done on its behalf by a Data Processor, and the duty to intimate sits with the Data Fiduciary.

DPDP breach notification: who to tell, and by when

Section 8(6) says that in the event of a personal data breach, the Data Fiduciary shall give the Board and each affected Data Principal intimation of the breach in the prescribed form and manner. Rule 7 of the DPDP Rules, 2025 supplies the detail.

The rule is triggered "on becoming aware of any personal data breach". As the text stands, small or low-risk incidents are not exempt.

Each affected Data Principal (Rule 7(1))

You must intimate each affected person without delay, in a concise, clear and plain manner, through her user account or any mode of communication she has registered with you. To the best of your knowledge, the message must cover:

• a description of the breach, including its nature, extent and timing;
• the consequences relevant to her that are likely to arise;
• the measures you have implemented, or are implementing, to mitigate risk;
• the safety measures she can take to protect her interests; and
• business contact information of a person who can answer her queries.

There is no seventy-two hour window here. The standard is "without delay".

The Board, in two steps (Rule 7(2))

1. Without delay: a description of the breach, including its nature, extent, timing and location of occurrence, and the likely impact.
2. Within seventy-two hours of becoming aware, or a longer period if the Board allows it on a written request: updated and detailed information, the broad facts and reasons leading to the breach, mitigation measures implemented or proposed, any findings about the person who caused it, remedial measures to prevent recurrence, and a report on the intimations given to affected Data Principals.

That last item matters. By hour seventy-two you must report on what you have told people, so informing them cannot wait for the investigation to finish. The Rules do not define "becoming aware", so decide in advance who can declare a breach and record the time.

Two clocks, two regulators

The CERT-In Directions of 28 April 2022, issued under Section 70B(6) of the Information Technology Act, 2000, require service providers, intermediaries, data centres, bodies corporate and government organisations to report specified cyber incidents within six hours of noticing them or being told of them. That rule is in force now.

The DPDP Act does not replace it. Section 38(1) says the Act's provisions are in addition to, and not in derogation of, any other law in force. From 13 May 2027, one incident involving personal data can start two clocks: six hours for CERT-In, and "without delay" followed by seventy-two hours for the Board, with affected people informed alongside. Regulated entities may have a third, set by a sector regulator such as RBI, SEBI or IRDAI.

The two regimes differ in scope. CERT-In's list is about cyber incidents. The DPDP definition turns on personal data. Test every incident against both.

Safeguards and penalties: what the Board will look at

Prevention comes first. Section 8(5) requires reasonable security safeguards to prevent a personal data breach, including for processing done by a Data Processor. Rule 6 sets the minimum:

• data security measures such as encryption, obfuscation, masking or virtual tokens;
• control over access to the computer resources used;
• logs, monitoring and review to detect unauthorised access;
• measures such as backups, so that processing can continue after a compromise;
• retention of the relevant logs for one year, unless another law requires otherwise;
• contracts with Data Processors that require reasonable security safeguards; and
• technical and organisational measures to make the safeguards work.

Logs deserve the most attention. Without them you cannot say what was accessed or whose data it was, which is what Rule 7 asks you to describe.

The Schedule to the Act sets the ceilings: up to Rs 250 crore for failing to take reasonable security safeguards, and up to Rs 200 crore for failing to give the Board or an affected Data Principal notice of a breach. These are maximums. Under Section 33(2), the Board must weigh the nature, gravity and duration of the breach, the type of data, and how timely and effective your mitigation was. Under Section 27(1)(a), it may also direct urgent remedial measures once it receives an intimation.

One caveat. As of early October 2026, we have found no notification appointing the Board's Chairperson or Members, and no filing channel has been published. Build the process now and add the filing step later.

A breach readiness checklist

1. Name an incident lead and a deputy with authority to declare a breach, and decide how the time of "becoming aware" is recorded.
2. Write one playbook covering CERT-In, the Board, your sector regulator and affected people, with timings side by side.
3. Draft the Data Principal notice now, with the five items from Rule 7(1), in plain language.
4. Check that you can reach people: a user account or registered contact for every Data Principal.
5. Switch on and keep logs for every system holding personal data, and test whether you can answer "what was accessed, and whose".
6. Review Data Processor contracts for security safeguards and a duty to tell you promptly about any incident.
7. Keep a breach register: what happened, when you became aware, whom you told and when.
8. Rehearse against the six hour and seventy-two hour marks.

For draft notices and an hour-by-hour plan, see our breach notification template and response playbook. For the consent side of your records, see our DPDPA consent guide.

How Consently helps

Consently is a DPDP-native consent management platform built by G. Giri & Partners LLP. Alongside consent management, a preference centre and a request centre for Data Principal rights, it includes a breach management centre, with reports and compliance dashboards for oversight. It does not replace your security tooling or incident response team, and decisions on when and what to intimate stay with you and your legal advisers.

Not sure where your organisation stands? Try our DPDP compliance calculator, or book a demo to see the breach management centre.

FAQ

What is the deadline for DPDP breach notification?

Under Rule 7, the Board and each affected Data Principal must be told without delay. The Board must then receive a detailed report within seventy-two hours of your becoming aware, unless it allows longer on a written request.

Do small breaches have to be reported?

Rule 7 applies to "any personal data breach" and sets no threshold of size or likely harm. Unless that changes, plan to intimate every breach that meets the definition in Section 2(u).

Does reporting to CERT-In satisfy the DPDP Act?

No. CERT-In reporting arises under the Information Technology Act, 2000. The DPDP Act adds a separate duty to intimate the Data Protection Board and each affected Data Principal, and Section 38(1) says the Act applies in addition to other laws.

When does the breach notification duty start?

From 13 May 2027, eighteen months after the DPDP Rules were notified on 13 November 2025. CERT-In's six hour reporting rule already applies.

This article is for general information and is not legal advice. Please consult a qualified lawyer for advice on your specific situation.