Data Breach
Notification

Under Rule 7 of the DPDP Rules 2025, a data fiduciary must intimate the Data Protection Board and affected data principals about a personal data breach without delay on becoming aware of it. An initial intimation is followed by detailed particulars — the nature, extent, timing, likely impact, and remedial measures — within 72 hours, a period the Board may extend on a written request showing good cause.

Yes. Unlike the GDPR, the DPDP Rules 2025 set no risk-based threshold — every personal data breach must be reported to the Data Protection Board and to each affected data principal, regardless of how minor it appears. This makes accurate breach detection and a documented assessment process essential.

Failure to notify a personal data breach can attract a monetary penalty of up to ₹200 crore per instance, and failure to maintain reasonable security safeguards (which often causes the breach) can attract up to ₹250 crore. Because penalties apply per instance, a single incident touching multiple obligations can compound quickly.

Two parties: the Data Protection Board of India, and every data principal whose personal data was affected. The data principal notification must be in clear, plain language and describe the breach, its likely consequences, the measures taken, and the steps the individual can take to protect themselves.

The intimation must describe the breach, the categories and approximate number of data principals and records affected, the likely consequences, the remedial and mitigation measures taken, and contact details of the Data Protection Officer or designated point of contact. Detailed particulars are then provided within 72 hours.