A personal data breach is one of the highest-risk moments under the DPDP Act: the failure to notify can attract a penalty of up to ₹200 crore, and the failure to maintain reasonable security safeguards up to ₹250 crore. Rule 7 of the DPDP Rules, 2025 sets specific notification duties and timelines. This page explains them and how KSK’s data-privacy team supports breach response.
The notification timeline
Under Rule 7, on becoming aware of a personal data breach a data fiduciary must:
Are you a Significant Data Fiduciary?
Answer 25 questions to see your DPDPA risk level and whether the DPO obligation applies to you — free, instant, with a branded PDF.
- Notify each affected data principal “without delay” — describing the breach (nature, extent, timing), the likely consequences, the mitigation taken, the safety steps the individual can take, and a contact point.
- Give the Data Protection Board an initial intimation “without delay”, followed by a detailed report within 72 hours (extendable on request) — covering updated facts, circumstances and reasons, remedial measures, findings on who caused it, and a summary of the notices sent to individuals.
Our detailed analysis is here: data breach notification obligations, along with the interaction with CERT-In’s reporting rules, which impose their own, faster timelines.
Why preparation matters
The 72-hour clock and the “without delay” standard leave little room to improvise. Organisations that have a breach-response playbook, defined roles, holding statements and notification templates ready tend to meet the timelines and limit exposure. Reasonable security safeguards beforehand (Section 8(5)) also reduce both the likelihood of a breach and the penalty risk — see reasonable security safeguards.
How KSK helps
We help clients before, during and after an incident: building breach-response playbooks and notification templates; advising in real time on whether an incident is a notifiable personal data breach and on parallel CERT-In and sectoral obligations; drafting and coordinating notifications to the Board and affected individuals; managing the 72-hour detailed report; and advising on remediation, regulator engagement and potential adjudication before the Data Protection Board.
Related reading
See our guides on penalties and adjudication and data-breach management. To assess your current readiness, use the free Compliance Scorecard.
Talk to KSK about your DPDP readiness
Our data-privacy team advises Indian and global businesses on the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. To understand where you stand, try our free DPDPA Compliance Scorecard or speak to our team.
This page is general information about Indian data-protection law and is not legal advice or a solicitation. Provisions of the DPDP Act and Rules are subject to phased commencement and further notification.
Explore KSK Data Privacy Hub
Free compliance tools and expert guidance covering 75+ jurisdictions.