How do you report a data breach under the DPDP Rules?
You tell the Data Protection Board and every affected person without delay, then send the Board a detailed report within 72 hours. Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules 2025 set this duty for every Data Fiduciary. There is no size or risk threshold: every personal data breach counts.
What counts as a personal data breach?
A personal data breach is any unauthorised processing of personal data, or its accidental disclosure, acquisition, sharing, use, alteration or destruction, or loss of access to it, that compromises its confidentiality, integrity or availability. A misdirected email with a customer list, a stolen laptop, ransomware that locks a patient database and an exposed storage bucket can all qualify.
What is the DPDP breach notification timeline?
The DPDP breach notification timeline has three steps, two of them immediate:
| Who | When | What to send |
|---|---|---|
| Each affected Data Principal | Without delay | A plain notice of what happened and what they can do |
| Data Protection Board | Without delay | A first intimation: the nature, extent, timing, location and likely impact of the breach |
| Data Protection Board | Within 72 hours of becoming aware, or longer if the Board allows | A detailed report on the facts, cause, mitigation and notices sent |
These duties apply from 13 May 2027, with the other business obligations in the DPDP Rules 2025. Other reporting duties, such as CERT-In's cyber incident directions or a sector regulator's rules, apply separately and can have their own deadlines.
What must you tell affected people?
The notice to affected people must be concise, clear and plain, sent through their user account or the contact they gave you, and cover:
- what happened: the nature, extent, timing and location of the breach;
- the consequences relevant to them that are likely to arise;
- what you have done or are doing to reduce the risk;
- the safety measures they can take to protect themselves;
- the business contact of a person who can answer their questions.
What goes in the 72-hour report to the Board?
The detailed report to the Board updates your first intimation and covers:
- the broad facts of the events, circumstances and reasons that led to the breach;
- the measures taken or proposed to mitigate the risk;
- any findings about the person who caused the breach;
- the remedial steps taken to stop it happening again;
- a report on the notices sent to affected Data Principals.
What happens if you don't report a breach?
Failing to notify the Board and affected people can lead to a penalty of up to ₹200 crore. If the breach happened because reasonable security safeguards were missing, a separate penalty of up to ₹250 crore can apply. The Board weighs how quickly you acted when setting the amount, so a prompt, documented response matters. See the full schedule in DPDP Act penalties.
How do you get ready before a breach happens?
- Write a breach playbook that names who decides, who drafts and who sends each notice.
- Keep templates for the Data Principal notice, the first intimation and the 72-hour report.
- Know where personal data lives, so you can tell quickly whose data was affected.
- Require every Data Processor by contract to tell you about a breach straight away.
- Keep logs that let you investigate: the Rules require processing logs to be kept for at least one year.
- Run a drill and record what you learned.
How GRC Flow helps
GRC Flow's breach register tracks each incident against the 72-hour Board report, with an owner and the notices sent, as part of its DPDP registers. It can also draft a breach playbook from your own data inventory and vendor list, which a person reviews before it is used (see DPDP documents).
Frequently asked questions
What is the breach notification timeline under the DPDP Rules?
Inform the Data Protection Board and each affected Data Principal without delay. Then send the Board a detailed report within 72 hours of becoming aware of the breach, or within a longer period if the Board allows it on a written request.
Do all personal data breaches need to be reported under the DPDP Act?
Yes. Unlike GDPR, the DPDP Act and Rules have no risk threshold. Every personal data breach must be reported to the Board and to the affected Data Principals.
What must a breach notice to affected people contain?
A plain description of the breach (its nature, extent, timing and location), the likely consequences for them, what the Data Fiduciary is doing to reduce the harm, the safety measures they can take, and a contact who can answer their questions.
What is the penalty for not reporting a data breach under the DPDP Act?
Up to ₹200 crore for failing to notify the Board and affected Data Principals. If the breach happened because reasonable security safeguards were missing, a separate penalty of up to ₹250 crore can also apply.
Does a Data Processor report breaches to the Board?
The duty to notify sits with the Data Fiduciary. The Data Fiduciary should require its processors by contract to tell it about any breach straight away, so it can meet the timeline.
Sources
- K&S Partners: DPDP data breach notification timeline
- PIB: Digital Personal Data Protection Rules, 2025
- AMLEGALS: Penalties under the DPDP Act, 2023
This guide explains the law in general terms and is not legal advice. Check specific situations with a qualified lawyer.