They expertly mapped the overlapping controls between SOC 2 and ISO 27001, which saved us from duplicating work.
Jasreet Kaur B.Silicon Physical Design Engineer · Small-BusinessSOC 2 + ISO 27001 · August 2026
DPDP RULE 7 · DETAILED PARTICULARS WITHIN 72 HOURS
DPDP countdown
Most DPDP duties apply from 13 May 2027.
Eighteen months after G.S.R. 843(E) and the DPDP Rules (G.S.R. 846(E)) were published in the Gazette dated 13 November 2025.
Countdown to 13 May 2027
Consent-manager registration rules take effect 13 November 2026
See every DPDP deadlineRule 7 of DPDP Rules 2025 mandates timely notification of personal data breaches to the Data Protection Board and affected Data Principals.
Every breach is reportable — initial intimation without delay, detailed particulars within 72 hours.
72hDetailed particulars deadline
₹200 CrNon-notification penalty
1,000+Audits delivered
DPDP Rules 2025 · Rule 7 · Data Protection Board of India · Last reviewed June 2026
Direct Answer
When must a breach be reported?
Under the DPDP Act 2023, a data fiduciary must notify the Data Protection Board and every affected data principal of a personal data breach without delay on becoming aware of it. Rule 7 of the MeitY DPDP Rules 2025 requires an initial intimation followed by detailed particulars within 72 hours, and unlike the GDPR it applies a no-threshold rule — every breach is reportable, with penalties reaching ₹200 crore for notification failures and ₹250 crore for inadequate security safeguards.
Key Takeaways
- Every personal data breach is reportable — the DPDP Rules 2025 set no risk-based threshold, so even minor incidents must be notified to the Board and affected data principals.
- Notify without delay on awareness, then provide detailed particulars within 72 hours (or a longer period the Board allows on a request made in writing).
- Notify two parties: the Data Protection Board of India and every affected data principal, in clear and plain language.
- Penalty ceilings are ₹200 crore for breach-notification failures and ₹250 crore for inadequate security safeguards, and one incident can engage both.
The Process
Breach Response Process
Step 1
Detect & Assess
Identify the breach and assess its scope, impact, and the personal data affected
Step 2
Contain & Mitigate
Take immediate steps to contain the breach and prevent further unauthorized access
Step 3
Notify the Board
Intimate the Data Protection Board about the breach in prescribed form and manner
Step 4
Notify Data Principals
Inform affected Data Principals about the breach and remedial actions
Deadlines
Notification Timeline
To Data Protection Board
Send a short description without delay, then the detailed report within 72 hours of becoming aware of the breach, or a longer period the Board allows on a written request.
To Affected Data Principals
Tell each affected person without delay, in a concise, clear and plain way, through their user account or a contact they registered with you. It does not wait for the Board.
The Stakes
Penalties for Breach-Related Defaults
The DPDP Act 2023 sets a penalty ceiling for each kind of default, and the Data Protection Board fixes the amount. Breach-related failures sit among the highest slabs.
| Default | Maximum penalty (ceiling) | Statutory basis |
|---|---|---|
| Failure to take reasonable security safeguards to prevent a breach | ₹250 crore | DPDP Act 2023, Schedule |
| Failure to notify the Board / data principals of a breach | ₹200 crore | DPDP Act 2023, Schedule |
| Breach of children's-data obligations | ₹200 crore | DPDP Act 2023, Schedule |
| Other defaults (residual) | ₹50 crore | DPDP Act 2023, Schedule |
Estimate your exposure with the DPDP penalty calculator. Penalties are indicative maximums. The Board determines the actual amount considering the nature and gravity of the default.
The Contents
What to Include in Notifications
Board Notification
- Without delay: a description of the breach, its nature, extent, timing and location (Rule 7(2)(a))
- Without delay: the likely impact of the breach
- Within 72 hours: updated and detailed information on that description (Rule 7(2)(b))
- Within 72 hours: the broad facts, circumstances and reasons that led to the breach
- Within 72 hours: measures implemented or proposed to mitigate risk
- Within 72 hours: any findings about the person who caused the breach
- Within 72 hours: remedial measures taken to prevent a recurrence
- Within 72 hours: a report on the intimations given to affected Data Principals
Data Principal Notification
- Nature of the personal data breach
- Possible consequences of the breach
- Measures taken to address the breach
- Measures Data Principal can take to protect themselves
- Contact information for more information
Proof
In their words.
Quotes verbatim from G2. Company names added where the client confirmed them.
Instead of simply providing generic templates or checklists, their team took the time to understand our environment and requirements.
Anand .Market Risk Analyst · Mid-MarketCompliance readiness · September 2026
The team’s willingness to work with us and ease of communication.
sam v.CEO · Small-BusinessSOC 2 Type I + ISO 27001 · August 2026
They delivered the project with speed, accuracy, and cost-effectiveness.
Maneet P.Mid-MarketSOC 2 · August 2026
My only regret is that we didn’t engage them sooner in our compliance journey, which would have saved us even more time.
Mahesh Raju C. · XonarSmall-BusinessSOC 2 · GRC · August 2026
They were always responsive and willing to go the extra mile whenever we had questions or needed guidance.
Chandan J. · DsiderSmall-BusinessSOC 2 Type I · August 2026
Managing the auditor relationship on our behalf was especially valuable — it took a lot of pressure off our internal team.
Achyut B.Senior Software Engineer · Small-BusinessSOC 2 + ISO 27001 · September 2026
Their focus on ensuring that we were genuinely audit-ready rather than simply completing documentation.
Ravi V.Founder & CEO · Mid-MarketSOC 2 Type II · August 2026
The guidance was not generic or simply based on a standard checklist — they suggested practical approaches that made sense for our business.
Verified UserInternational Trade and Development · Small-BusinessSOC 2 + ISO 27001 · September 2026
What I like best is the hands-on support and clear guidance throughout the SOC 1 and SOC 2 process.
Sai Sudha S. · ExcersSmall-BusinessSOC 1 + SOC 2 · September 2026
Frequently Asked Questions
Common questions on DPDP breach notification, timelines, and penalties.
What is the timeline to report a data breach under the DPDP Act?
Under Rule 7 of the DPDP Rules 2025, a data fiduciary must intimate the Data Protection Board and affected data principals about a personal data breach without delay on becoming aware of it. An initial intimation is followed by detailed particulars — the nature, extent, timing, likely impact, and remedial measures — within 72 hours, or within a longer period the Board allows on a request made in writing.
Does every data breach have to be reported under the DPDP Act?
Yes. Unlike the GDPR, the DPDP Rules 2025 set no risk-based threshold — every personal data breach must be reported to the Data Protection Board and to each affected data principal, regardless of how minor it appears. This makes accurate breach detection and a documented assessment process essential.
What are the penalties for failing to report a data breach?
Failure to give the Board or affected data principals notice of a personal data breach can attract a monetary penalty of up to ₹200 crore, and failure to take reasonable security safeguards (which often causes the breach) up to ₹250 crore. These are ceilings in the Act’s Schedule, and the Board fixes each amount after weighing the factors in section 33(2). One incident can engage both entries.
Who must be notified when a personal data breach occurs?
Two parties: the Data Protection Board of India, and every data principal whose personal data was affected. The data principal notification must be in clear, plain language and describe the breach, its likely consequences, the measures taken, and the steps the individual can take to protect themselves.
What information must a breach notification to the Board contain?
Rule 7(2) sets two stages. Without delay, a description of the breach covering its nature, extent, timing and location, and its likely impact. Then within 72 hours, or a longer period the Board allows on a request made in writing, updated and detailed information on that description, the broad facts and reasons that led to the breach, measures implemented or proposed to mitigate risk, any findings about the person who caused it, remedial measures to prevent a recurrence, and a report on the intimations given to affected data principals.
Continue your DPDP research
- DPDP Act compliance hub — the full guide to the Act, Rules 2025, and phased deadlines.
- DPDP compliance consulting in India — breach playbooks, gap assessments, and end-to-end implementation.
- DPDP penalty calculator — model your exposure across breach and security-safeguard defaults.
- Tranquility Cybersecurity credentials & proof — our certifications and track record.
Keep Exploring
Related Reading
Privacy
DPDP Knowledge Hub
Rules 2025, penalties, SDF obligations and 14 deep-dive guides.
Read morePrivacy
DPDP Penalties & Enforcement
Penalty tiers up to ₹250 Cr and the Data Protection Board process.
Read morePrivacy
DPDP Compliance Checklist
A step-by-step checklist for DPDP Act readiness.
Read morePrivacy
Significant Data Fiduciary
Enhanced obligations for large-scale data processors under the DPDP Act.
Read moreHIPAA
HIPAA Breach Notification
Reporting timelines and obligations after a PHI breach.
Read moreFree Tool
Breach Reportability Checker
See if an incident is notifiable under DPDP, CERT-In, GDPR, HIPAA or PCI.
Read moreDPDP course · Module 4 of 8
Previous4.1 The rights people have under the ActCourse map8 modules · 79 lessons · 24 readyNext4.8 Penalties and how enforcement works
Next in the course: 4.5 Fifteen incidents: reportable or not?. Surendra Pal Singh is writing it.