DPDP breach notification: telling people and the Board within 72 hours

Sehmat team · 20 September 2026

Under Rule 7 of the DPDP Rules, 2025, when you become aware of a personal data breach you must tell each affected person without delay, in clear and plain language. You must also tell the Data Protection Board without delay. Then, within 72 hours of becoming aware, you must send the Board a detailed report, unless the Board allows more time on a written request.

These duties apply from 13 May 2027. Planning now makes the first real incident calmer.

Key points

Section 8(6) of the Act requires notice of a breach to the Board and each affected Data Principal. Rule 7 sets out how.
Tell each affected person “without delay”, through her user account or a contact mode she registered with you (Rule 7(1)).
Tell the Board “without delay” with a first description (Rule 7(2)(a)).
Send the Board a detailed report within 72 hours of becoming aware, or within a longer period the Board allows on written request (Rule 7(2)(b)).
The 72-hour report includes a report on the notices you gave to affected people (Rule 7(2)(b)(vi)).
The Act’s Schedule allows a penalty of up to ₹200 crore for failing to give these notices.

What counts as a personal data breach?

The Act defines a personal data breach as any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to it, that compromises its confidentiality, integrity or availability (s.2(u)). A lost register, an email sent to the wrong list or an exposed database can all count.

There is no minimum size. Rule 7 applies on “becoming aware of any personal data breach”.

What must the notice to each person say?

Rule 7(1) says the notice must be concise, clear and plain, and must include:

a description of the breach, including its nature, extent and when it happened;
the consequences relevant to her that are likely to arise;
what you have done and are doing to reduce the risk, if anything;
safety steps she can take to protect herself; and
business contact details of a person who can answer her questions.

Write for the person, not for a regulator. Say what happened, what it means for them, and what to do next. If your people read Hindi or Tamil, a notice only in English will not be clear to them.

What must you send the Board, and when?

Without delay: the first intimation

Rule 7(2)(a) asks for a description of the breach, covering its nature, extent, timing, location and likely impact. Send what you know. You can update it later.

Within 72 hours: the detailed report

Rule 7(2)(b) asks for:

updated and detailed information on the description;
the broad facts about the events, circumstances and reasons that led to the breach;
measures taken or proposed to reduce risk;
any findings about the person who caused the breach;
remedial steps to prevent it happening again; and
a report on the intimations given to affected people.

The clock starts when you become aware of the breach, not when the investigation ends. If you need more time, ask the Board in writing.

A breach playbook you can prepare now

Before anything happens

Name a breach lead and a deputy. Write down who can decide to notify.
Keep contact data clean. Rule 7(1) uses the person’s account or registered contact mode. Out-of-date numbers slow everything down.
Draft templates. Prepare a person-facing notice and a Board intimation in English and the languages your people read. Leave blanks for the facts.
Keep logs. Rule 6 requires logs, monitoring and backups, with logs kept for one year. They are how you work out the extent of a breach.
Check vendor contracts. Add a breach-notice clause to processor contracts (Rule 6(1)(f) asks for security terms in them).

Hour 0 to 6

Record the time you became aware.
Contain the breach: revoke keys, close access, recover records.
Start a written log of decisions and evidence.
As soon as you have the basic facts, send the first intimation to the Board.
If the CERT-In Directions of 28 April 2022 apply, report the cyber incident to CERT-In within 6 hours of noticing it.

Hour 6 to 24

Work out who is affected and how.
Start notifying affected people without waiting for the full report.

Hour 24 to 72

Finish the person notices and keep a list of who was told, when and how.
Complete the detailed Board report, including the intimation report.
If you cannot finish in time, request an extension in writing before the deadline.

Afterwards

Fix the cause, and record the fix.
Run a short review. Update the templates and the playbook.

How Sehmat helps

Sehmat tracks the 72-hour Board clock on every incident and flags the report when it is overdue.
Each affected person gets a Rule 7 notice by email and SMS. The SMS link opens after an OTP check, and opens are recorded.
You keep a list of who was told, ready for the Rule 7(2)(b)(vi) report.
A hash-chained audit log, verified nightly, helps show what happened and when.

Sources

This article is general information, not legal advice.