DPDP breach notification: without delay, then a 72-hour report

Two stages

1. Without delay: tell each affected person (what happened, likely consequences, what you are doing, what they can do, a contact) and give the Data Protection Board an initial intimation.
2. Within 72 hours of becoming aware (or longer if the Board allows): a detailed report to the Board with the facts, causes, mitigation, findings about who caused it, and remedial steps.

There is no materiality threshold in the Act: every personal data breach is notifiable.

How it overlaps CERT-In

CERT-In's April 2022 directions separately require many organisations to report specified cyber incidents within 6 hours. The DPDP duty doesn't replace it: run both clocks from the same incident timeline.

Engineering runbook

• Know where personal data lives, so you can say what was exposed within hours, not weeks.
• Keep access logs (Rule 6 expects a year) that let you reconstruct who read what.
• Prepare notification templates and a contact list before you need them.
• Record every decision with a timestamp; the 72-hour report needs a timeline.

{
  "detectedAt": "2027-06-01T09:12:00+05:30",
  "boardIntimatedAt": null,
  "principalsNotifiedAt": null,
  "detailedReportDueBy": "2027-06-04T09:12:00+05:30",
  "dataCategories": ["email", "phone"],
  "recordsAffected": 0,
  "containment": []
}

This guide explains engineering work, not legal advice. Dates are counted from the Rules' notification on 13 November 2025; confirm them against the official Gazette text and your counsel, as MeitY may amend the timeline.

FAQ