DPDP Data Breach Notification in India: Timelines, Requirements and Key Compliance Considerations

A personal data breach can create immediate legal, operational and reputational consequences for an organisation. Under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules), specific obligations have been prescribed for Data Fiduciaries following a personal data breach. While organisations may already have broader data protection and cybersecurity measures in place, breach notification requires a distinct and time-sensitive response. The DPDP framework requires communication both to affected Data Principals and to the Data Protection Board of India.

The DPDP Rules were notified on 13 November 2025 and provide for phased commencement. The substantive provisions relating to breach notification are scheduled to come into force after 18 months, i.e. in May 2027. Organisations should nevertheless use the implementation period to establish and test their breach notification processes.

This article focuses specifically on DPDP breach notification requirements in India, including the applicable timelines, information to be provided and practical considerations for organisations responding to a personal data breach.

What Is a Personal Data Breach Under the DPDP Act?

The DPDP Act defines a personal data breach broadly as a breach of security that leads to accidental or unauthorised processing of personal data, or accidental loss, destruction, alteration or disclosure of, or access to, personal data. A breach may therefore arise from circumstances such as:

• unauthorised access to personal data;
• accidental disclosure of personal data;
• loss or destruction of personal data;
• unauthorised alteration of personal data; or
• a cyber incident resulting in unauthorised access to personal data.

The identification of a breach should trigger the organisation’s incident assessment and notification process.

What Does the DPDP Act Require After a Personal Data Breach?

Section 8(6) of the DPDP Act requires a Data Fiduciary to give intimation of a personal data breach to:

1. the Data Protection Board of India; and
2. each affected Data Principal,

in the form and manner prescribed by the DPDP Rules.

Rule 7 of the DPDP Rules provides the detailed notification framework. The important feature of this framework is that notification obligations operate on two parallel tracks: communication to affected individuals and reporting to the Board.

DPDP Breach Notification Timeline: What Is the 72-Hour Rule?

One of the most important questions for businesses is: “What is the DPDP data breach notification deadline?” Under Rule 7, the Data Fiduciary must provide an initial intimation to the Data Protection Board without delay. This initial communication must include information concerning the nature, extent, timing and location of the breach and its likely impact.

The Data Fiduciary must subsequently submit a detailed report within 72 hours of becoming aware of the personal data breach, unless the Board permits a longer period on a written request. The organisation should therefore have a clear internal process for recording when it became aware of a breach. Waiting for a complete forensic investigation before commencing the regulatory response may create unnecessary delays. Where additional time is required, the organisation should consider making an appropriate written request to the Board with reasons supporting the request.

What Must Be Communicated to Affected Data Principals?

The DPDP Rules require the Data Fiduciary to notify each affected Data Principal without delay. The notification should be concise, clear and in plain language and should include:

• a description of the personal data breach, including its nature, extent and timing;
• the likely consequences of the breach for the affected individual;
• measures already implemented or being implemented to mitigate the risks;
• safety measures that the Data Principal may take to protect their interests; and
• business contact information of a person who can respond to queries on behalf of the Data Fiduciary.

The emphasis on plain-language communication is significant. A breach notification should not merely reproduce a technical incident report. It should explain the incident in a manner that enables the affected individual to understand the potential implications and take appropriate protective steps.

What Information Must Be Reported to the Data Protection Board?

The detailed report to the Board must provide a fuller account of the incident. It is required to include, among other matters:

• updated and detailed information concerning the breach;
• the broad facts relating to the events and circumstances leading to the breach;
• the reasons for the breach, where known;
• measures implemented or proposed to mitigate its effects;
• findings regarding the person who caused the breach, where applicable;
• remedial measures taken to prevent recurrence; and
• details of the notifications provided to affected Data Principals.

Companies should therefore maintain a central record of the incident from the time it is detected. This can help ensure that the information required for the detailed report can be compiled within the prescribed period.

What Should Companies Do When a Data Breach Occurs?

Although the specific response will depend on the nature of the incident, organisations should have a defined sequence for handling a suspected personal data breach.

1. Identify and assess the incident: The organisation should establish whether personal data is involved and identify the systems, categories of data and individuals potentially affected.
2. Contain the incident: Immediate steps should be taken to prevent further unauthorised access or disclosure while preserving relevant evidence for investigation.
3. Record the timeline: The organisation should document when the incident was detected, when personal data involvement was established and when the Data Fiduciary became aware of the breach.
4. Assess notification requirements: The legal, privacy and cybersecurity teams should assess the applicable DPDP notification requirements alongside any other regulatory, contractual or sector-specific obligations.
5. Prepare notifications: Pre-approved templates can help organisations prepare communications to Data Principals and the Board within the required timelines.
6. Remediate and document: Following notification, the organisation should address the underlying cause, implement corrective measures and maintain appropriate records of the response.

This process should ideally be tested periodically through simulated breach exercises.

DPDP Breach Notification and CERT-In Reporting

A personal data breach may also constitute a cybersecurity incident requiring reporting under the CERT-In Directions, depending on the nature of the incident. The two frameworks serve different purposes. The DPDP framework focuses on the protection of personal data and the rights and interests of Data Principals, while CERT-In reporting is directed towards specified cybersecurity incidents.

Accordingly, an organisation should not assume that compliance with one reporting framework automatically satisfies the other. A single incident-response process should instead identify all potentially applicable obligations, including:

• DPDP reporting;
• CERT-In reporting;
• sector-specific regulatory requirements;
• contractual notification obligations; and
• applicable law-enforcement requirements.

What Happens When the Breach Involves a Data Processor?

Many organisations rely on third-party service providers to process personal data. A breach may therefore occur within the systems of a cloud provider, technology vendor, payroll service provider or other Data Processor. The statutory notification responsibility under Section 8(6) rests with the Data Fiduciary. Data Processor arrangements should consequently provide for prompt escalation of suspected breaches to the Data Fiduciary, together with sufficient information and cooperation to enable the Fiduciary to assess and discharge its obligations.

For organisations, this makes contractual incident-notification provisions an important part of their overall breach-response framework.

What Are the Penalties for DPDP Breach Notification Failures?

The DPDP Act provides for significant financial penalties. Failure to comply with the obligation concerning notification of a personal data breach under Section 8(6) may attract a penalty of up to ₹200 crore. Separately, failure to take reasonable security safeguards to prevent personal data breaches may attract a penalty of up to ₹250 crore. The potential exposure therefore extends beyond the notification itself and may also involve questions concerning the organisation’s underlying security safeguards and compliance framework.

DPDP Breach Notification: Key Questions for Businesses

When does the 72-hour DPDP reporting period begin?

The 72-hour period for the detailed Board report runs from the point at which the Data Fiduciary becomes aware of the personal data breach.

Does the organisation have to wait until the investigation is complete before notifying the Board?

No. The notification framework requires an initial intimation without delay, followed by the detailed report. Organisations should not structure their response around waiting for the completion of a full forensic investigation before initiating the notification process.

How quickly must affected individuals be notified?

Affected Data Principals are to be notified without delay in accordance with Rule 7.

Can the 72-hour period be extended?

The Board may permit a longer period for the detailed report where the Data Fiduciary makes a written request.

What is the maximum penalty for failure to notify a personal data breach?

A failure to comply with the breach-notification obligation under Section 8(6) may attract a penalty of up to ₹200 crore.

Conclusion

The DPDP framework introduces a structured and time-sensitive regime for personal data breach notification in India. For organisations, the key challenge is not merely understanding the 72-hour reporting requirement but ensuring that the internal processes needed to meet that requirement are capable of operating under the pressure of an actual incident.

Organisations should therefore establish clear escalation mechanisms, maintain appropriate incident records, prepare notification templates and ensure coordination between legal, privacy, cybersecurity and business teams. With the substantive breach-notification provisions scheduled to take effect in May 2027, the present implementation period provides organisations with an opportunity to test their processes and address gaps before the requirements become fully applicable.

For businesses operating across multiple regulatory environments, DPDP breach notification should also be incorporated into a broader incident-response framework capable of addressing CERT-In and applicable sector-specific obligations alongside data protection requirements.

Frequently Asked Questions