DPDP Data Breach Notification: Who to Tell and When

In short. Every personal data breach has to be reported, with no minimum size. Affected users must be told without delay. The Data Protection Board gets a first notice without delay and a detailed report within 72 hours. These obligations apply from 13 May 2027, but CERT-In's six-hour reporting rule for cyber incidents already applies today. Failing to give notice can cost up to Rs. 200 crore, separately from the penalty for the security lapse itself.

When this starts to apply

The DPDP Rules, 2025 were notified on 13 November 2025 and come into force in stages. The substantive duties of a Data Fiduciary, including the security safeguards in Rule 6 and the breach notices in Rule 7, apply from 13 May 2027. Until then, nothing in the DPDP framework obliges a business to report a breach.

That does not mean a breach today can go unreported. The CERT-In Directions of April 2022 are already in force, and they reach most businesses that run IT systems. More on those below.

13 May 2027 is about seven months away. For a company that has never written down who does what when something goes wrong, that is not long.

What counts as a personal data breach

Section 2(u) of the Act defines it as any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability.

The definition is wider than most people expect. A hacker downloading a customer table is a breach. So is an employee emailing a spreadsheet of customer phone numbers to the wrong distribution list, a misconfigured storage bucket left open to the internet, and a ransomware attack that locks you out of your own records even if nothing is copied. Loss of access counts.

The Act also sets no threshold. The European GDPR lets a company skip notifying the regulator where a breach is unlikely to result in risk to people. Section 8(6) has no such filter. If personal data was breached, both notices are owed.

Responsibility stays with you when a vendor causes the breach. Section 8(1) makes the Data Fiduciary responsible for processing done on its behalf by a Data Processor, whatever the contract says. If your payroll provider or CRM vendor leaks your data, the notices are yours to send.

The two notices

To whom	When	What it must contain
Each affected Data Principal (Rule 7(1))	Without delay	What happened, including its nature, extent and timing; the likely consequences for that person; what you have done or are doing to reduce the risk; what they can do to protect themselves; and contact details of someone who can answer their questions.
Data Protection Board, first notice (Rule 7(2)(a))	Without delay	A description of the breach: its nature, extent, timing and location, and the likely impact.
Data Protection Board, detailed report (Rule 7(2)(b))	Within 72 hours of becoming aware, or a longer period the Board allows on a written request	Updated details; the facts and reasons that led to the breach; mitigation measures; any findings about who caused it; steps taken to stop it happening again; and a report on the notices sent to affected users.

Two things in that table are easy to miss. The user notice has no fixed number of hours, but "without delay" is a stricter standard than it sounds, and the Board's 72-hour report has to describe the user notices you sent. In practice, users are told before the 72 hours run out, or the Board report has an awkward gap in it.

The user notice must go through the person's account or a contact method they have registered with you. A press release or a banner on your website does not meet the rule on its own.

When the clock starts

Both deadlines run from the moment the Data Fiduciary becomes aware of the breach, not from the moment the investigation is finished. Awareness is a question of fact. If an engineer saw the alert on Friday night and told nobody until Monday, the Board is likely to treat Friday as the start.

Two practical consequences follow. Someone has to own breach reports, with the authority to start the process at any hour. And your contracts with processors should require them to tell you about a breach within a fixed and short period, so their delay does not become yours.

CERT-In runs alongside

On 28 April 2022 CERT-In issued Directions under Section 70B(6) of the Information Technology Act, 2000. They require specified cyber incidents to be reported to CERT-In within six hours of noticing them, and ICT system logs to be kept for a rolling 180 days within India. They apply to service providers, intermediaries, data centres and body corporates, which takes in most companies.

The DPDP Rules did not replace them. A breach caused by an attack can therefore mean three reports: CERT-In within six hours, the Board's first notice without delay, and the Board's detailed report within 72 hours, plus the notices to users. The log rules differ too. Rule 6 of the DPDP Rules asks for logs and related personal data to be kept for one year, unless another law requires otherwise; CERT-In asks for 180 days. Keep them for the longer period.

A working timeline for the first 72 hours

Every incident is different, but the sequence below is a sensible default once the Rules apply.

First hours. Contain the breach and preserve evidence. Do not wipe and rebuild servers before logs are copied. If it is a cyber incident within CERT-In's list, its six-hour report is due in this window.
Same day. Send the Board its first notice, with what you know so far. It can be updated. It is meant to be early and incomplete.
As soon as you know who is affected. Send the user notices. If you cannot yet say exactly what was taken, say so, and tell people what you are doing to find out.
Before 72 hours. File the detailed report, including a summary of the user notices sent. If the investigation genuinely needs longer, ask the Board in writing for more time before the 72 hours expire, and give reasons.

Writing the user notice

The rule asks for a concise, clear and plain notice. Lawyers tend to write the opposite. A notice that reads like a disclaimer will annoy people and may not satisfy the Board either.

Something along these lines covers all five required points:

On 14 June we found that an unauthorised person had accessed one of our customer databases between 11 and 13 June. The records included your name, phone number and delivery address. Your password and payment details were not in that database.

You may receive calls or messages from people pretending to be us. We never ask for an OTP or card number over the phone.

We have closed the access route, reset internal credentials and engaged an outside security firm to investigate.

If you have questions, write to our grievance officer, Ms. A. Sharma, at [email protected].

It is short, and it says plainly what is not yet known. Avoid "out of an abundance of caution" and "we take your privacy seriously". People have learnt to read those phrases as a sign that something worse is coming.

Penalties

The Schedule to the Act treats the security failure and the reporting failure as separate contraventions:

failure to take reasonable security safeguards under Section 8(5): up to Rs. 250 crore;
failure to give the Board or an affected Data Principal notice of a breach under Section 8(6): up to Rs. 200 crore.

Both are ceilings. Section 33(2) lists what the Board has to weigh in fixing the amount, and one of those factors is whether the business acted to mitigate the effects of the breach, and how quickly and effectively it did so. Prompt, honest notice is one of the few things that works in a company's favour once a breach has happened.

What to have ready before anything happens

A named person who owns breach response, and a deputy for when they are on leave.
The business contact the user notice has to name, agreed in advance.
Draft notices for users and for the Board, with gaps to fill in.
Processor contracts that require prompt breach notice and cooperation with your investigation.
Logs kept for at least a year, somewhere an attacker cannot delete them.
Current contact details for your users. A notice you cannot deliver is not much use.

A short tabletop exercise once a year, where the team walks through a made-up incident against this list, shows up most of the gaps.

Common mistakes

Waiting for the investigation to finish before telling anyone. The first Board notice is meant to be early.
Treating a misdirected email or an exposed spreadsheet as too small to report. The Act has no threshold.
Assuming the vendor who caused the breach will handle the notices.
Notifying CERT-In and assuming that covers the Board, or the other way round.
Letting the 72 hours pass without either filing the report or asking for more time in writing.

Frequently asked questions

Rule 7(2) of the DPDP Rules, 2025 requires two reports to the Data Protection Board. The first, describing the breach and its likely impact, goes without delay. The second, with detailed facts, causes, mitigation, remedial measures and a report on the notices sent to users, is due within 72 hours of becoming aware of the breach, or within a longer period the Board allows on a written request.

Rule 7(1) does not fix a number of hours for users. It requires each affected Data Principal to be told without delay, in a concise, clear and plain manner, through their user account or a registered mode of communication. In practice the user notice should go out as soon as the business knows who is affected and what they should do.

Section 8(6) of the DPDP Act, 2023 contains no threshold based on size or likely harm. Any personal data breach as defined in Section 2(u), which includes accidental disclosure and loss of access, has to be reported to the Board and to each affected Data Principal.

Under item 2 of the Schedule to the DPDP Act, 2023, failing to give the Board or an affected Data Principal notice of a personal data breach can attract a penalty of up to Rs. 200 crore. Failing to keep reasonable security safeguards under Section 8(5) is a separate contravention, with a penalty of up to Rs. 250 crore.

The CERT-In Directions of 28 April 2022, issued under Section 70B(6) of the Information Technology Act, 2000, require specified cyber incidents to be reported to CERT-In within six hours of noticing them. They operate under a different statute and the DPDP Rules do not replace them, so a breach caused by a cyber incident can mean reports to both CERT-In and the Data Protection Board.

Data breach under the DPDP Act: who has to be told, and by when.