DPDP breach notification: what to report and when

Under the DPDP Act and Rules, a company that suffers a personal data breach must tell each affected person and the Data Protection Board without delay, and give the Board a fuller report within 72 hours unless the Board allows longer. These duties apply from 13 May 2027. CERT-In's separate six-hour reporting already applies.

Key points

• The breach duty sits in section 8(6) of the DPDP Act and is detailed in rule 7 of the DPDP Rules, 2025.
• Two audiences must be told: each affected Data Principal (the person the data is about) and the Data Protection Board.
• The Board gets a first intimation without delay and a detailed report within 72 hours, or a longer period if the Board allows it.
• CERT-In's six-hour reporting is a separate obligation and does not go away when the DPDP duties start.
• The Schedule to the Act sets a maximum penalty of ₹200 crore for failing to give the breach notice to the Board or affected people.

What counts as a personal data breach under the DPDP Act?

Section 2 of the Act defines a "personal data breach" broadly. It covers any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability.

Two things follow from that wording. First, a breach is not only a hacker stealing a database. A misdirected email, a spreadsheet shared with the wrong people, or ransomware that locks the company out of its own records can all fit the definition. Second, the text of section 8(6) and rule 7 does not set a minimum size or harm threshold, and does not say that small breaches may be skipped.

When do the DPDP breach rules start?

The DPDP Rules were notified on 13 November 2025. Rule 1 starts the rules in stages. The Data Protection Board provisions took effect on notification. Consent Manager registration can begin from 13 November 2026. Most other duties, including the breach duty in rule 7 and the security rule in rule 6, apply from 13 May 2027, eighteen months after notification.

Before 13 May 2027 the DPDP breach duty is not yet in force. That is a planning window, not a reason to wait: the processes needed take time to build and test.

Who must be told, and how quickly?

Section 8(6) of the Act says that when a personal data breach occurs, the Data Fiduciary (the organisation deciding why and how the data is used) must inform the Board and each affected Data Principal, in the form and manner prescribed. Rule 7 sets out that form and manner.

Affected Data Principals. On becoming aware of a breach, the Data Fiduciary must inform each affected person without delay. The rule asks for this to be done in a concise, clear and plain way, through the person's user account or another mode they have registered for communication with the company.

The Board. Rule 7 has two steps:

1. Without delay, a description of the breach, including its nature, extent, timing and location, and its likely impact.
2. Within 72 hours of becoming aware of the breach, or a longer period if the Board allows it, a more detailed report.

The 72 hours therefore applies to the detailed report. The first intimation to the Board is not held back until then.

What must the notices say?

The notice to each affected person, under rule 7, should cover:

• a description of the breach, including its nature, extent, timing and location;
• the consequences that are likely to arise for that person;
• the measures the company has taken or is taking to reduce the risk;
• safety steps the person can take to protect their interests; and
• business contact details of someone who can answer questions.

The detailed report to the Board, under the same rule, covers the broad facts of the events and the reasons that led to the breach, the mitigation measures, findings about who caused it (where known), the steps taken to prevent a repeat, and a report on the notices given to affected people.

In practice that means the company needs to be able to establish quickly what happened, which people are affected, and how to reach them. A company that cannot say which customers' data was in a compromised system will struggle to meet either step.

How does this fit with CERT-In's six-hour reporting?

The two regimes run side by side. The CERT-In Directions of 28 April 2022, issued under section 70B(6) of the Information Technology Act, 2000, require service providers, intermediaries, data centres, body corporates and government organisations to report specified cyber incidents to CERT-In within six hours of noticing them or being told of them. The incident types are listed in an annexure to the Directions; the list includes unauthorised access of IT systems and data, and readers should check the annexure itself for the full list. CERT-In may also require further action or information by order or direction. The Directions also require relevant logs to be kept for 180 days, within India.

The differences are worth keeping straight:

• Recipient. CERT-In receives the cyber incident report. The Data Protection Board and affected individuals receive the DPDP notices.
• Trigger. CERT-In's trigger is a listed type of cyber security incident. The DPDP trigger is a personal data breach as defined in the Act.
• Timing. Six hours for CERT-In. Without delay, then 72 hours for the Board's detailed report, under DPDP.
• Status. CERT-In reporting is already in force. The DPDP breach duty applies from 13 May 2027.

One incident can trigger both. A company that has a single incident log, with timestamps for when the incident was noticed, can feed the same facts into each report.

What does the security safeguards rule have to do with breaches?

Section 8(5) of the Act requires a Data Fiduciary to protect personal data in its possession or under its control by taking reasonable security safeguards to prevent a breach. Rule 6 says what "reasonable" includes at a minimum. It lists measures such as encryption, obfuscation or masking of data, controls over who can access systems, logging and monitoring to detect unauthorised access, and data backups. It also asks for logs and the related personal data to be retained for one year, unless another law requires otherwise, and for security obligations to be written into contracts with Data Processors.

The Schedule to the Act sets the maximum penalty for failing to take reasonable security safeguards at ₹250 crore, and for failing to give the breach notice to the Board or affected people at ₹200 crore. These are ceilings. Under section 33 of the Act, the Board may impose a penalty only after an inquiry, and the amount depends on the factors that section lists.

What can a company prepare before 13 May 2027?

The following is general good practice drawn from the structure of rule 7, not a legal requirement in itself. In short: know where personal data sits, record when an incident is noticed, decide in advance who judges whether an incident is a personal data breach, and have notice templates and contact routes ready. The checklist below sets out the steps.

Common questions

Does the DPDP Act require reporting every breach, however small? The text of section 8(6) and rule 7 does not carry a size or harm threshold for notifying the Board and affected people. Whether a particular event meets the definition of a personal data breach in section 2 is a question of facts.

Is the 72-hour deadline the time to first tell the Board? No. Rule 7 asks the Board to be told without delay, and 72 hours (or a longer period the Board permits) is the time for the detailed report that follows.

If we report to CERT-In, have we met the DPDP duty? No. The two are separate obligations with different recipients and triggers. A CERT-In report does not replace the notices to the Data Protection Board and to affected people.

General information, not legal advice. Prepared with AI assistance and checked against the official sources cited. Laws change; check the date above.