DPDP Breach Notification: 7 Essential Steps to Build an Effective Response Process
What would happen if a breach of your company’s customer database occurred on Friday night? And what if the customers’ phone numbers and email addresses had been posted on the internet by Monday morning? How quickly would you let the affected people know, and whom would you inform?
It is a requirement under India’s Digital Personal Data Protection (DPDP) Act to report a breach of data protection laws, not merely a kind gesture. If a breach is not reported, there could be a loss of time. The purpose of this article is to explain what the law requires and to outline a simple procedure for notifying the Data Protection Board of India of a breach.
What is considered to be a breach?
A data breach on a personal scale occurs when private information is stolen, leaked, lost, or altered without permission, for example as a result of a cyberattack, because of lost hardware, due to misdelivered emails, or as a consequence of accidental internal sharing of data.
What is the Data Protection Board?
The Data Protection Board of India (DPBI) is the official regulatory authority set up by the DPDP Act and has the responsibility of gathering notifications concerning data breaches, auditing the way in which businesses deal with such incidents, and imposing fines on organisations that break the law.
Who must report?
The entire liability falls on the data fiduciary, which is the entity that sets the purpose and method for processing personal data. Examples are startups, educational institutions, healthcare centers, and online shopping sites that harvest user information.
Third-Party Vendor Pitfall: In case your company utilizes the services of a third-party vendor (Data Processor), and their system gets breached, then the legal liability for breach notification still lies with your organization. Processors don’t notify the Board; you do. Make sure your contract with the processor demands immediate breach notifications to save you from running late.
​
What the rules require
Rule 7 of the DPDP Rules 2025 mandates organizations to inform two types of persons in case of personal data breach:
1. The Affected Individuals (Data Principals)
When: Immediately (no delay) after coming to know about the breach.
How: Via the user account or their registered contact address.
What to inform: An informative message in simple language regarding what happened, any possible impacts, preventive measures, and contact details of business.
2. The Data Protection Board of India (DPBI)
Stage 1 (First Notification): Inform the Board immediately without any delay.
Stage 2 (Final Report): Submit the report within 72 hours after becoming aware of the breach.
Extension: Written request may be made to seek more time to submit the report.
Report Requirements: The report should state the event details, kind of data affected, possible reason for the event, measures taken to reduce risk, and preventive measures.
​
The cost of getting it wrong
The penalties can be serious; not informing of a breach may result in fines of as much as ₹200 crore, and inadequate security measures could lead to penalties of up to ₹250 crore. A well-tested plan is considerably less expensive.
​
How to build your process
- Assign a Response Owner: Choose a clear lead (such as your Data Protection Officer) and also someone who will serve as an alternative to handle the incident.
- Promote Reporting of Issues: Ensure that your employees are well trained on how to report any issue. Create an environment where your employees feel free to report any possible breach.
- Record Discovery of Breach Date/Time: Note the specific date and time when you discover that there has been a breach. This is when the compliance countdown begins.
- Contain the Risk: Disconnect affected parties from the system. Fix any security vulnerabilities while meeting your reporting obligations.
- Maintain Logs: Record everything in chronological order, including timelines, data exposed, individuals involved, and remedies.
- Prepare Drafts: Create pre-written templates of communication to use during your first board communication, 72-hour notification, and user communications.
- Conduct Simulations: Perform simulations of your breach response plan every few months.
Writing to affected people
Explain what took place, what information was lost, what dangers exist, how to deal with it, and what the affected individuals must do, such as possibly change their passwords; mention also a contact person. Don’t use any legalese.
​
Mistakes to avoid
- There is no need to wait for full fact-finding before alerting the authorities or the users.
- Disregarding “minor” events: It is wrong to dismiss minor events since even minor breaches could result in significant legal violations.
- Absence of designated leaders: ensure order in the face of decentralization through appointment of an incident response owner.
- Not keeping track of the precise time the event occurred would mean missing out on the regulatory deadlines.
- Being unclear about notices to the customers: do not lose the users by using complex terminology in alerting them.
- Absence of an incident log: do not fail to document; failing to do so would be legally dangerous for your organization.
A note on timing
Keep an eye on the announcements made by MeitY and DPBI for dates for phased implementation and report templates. If you set up your internal procedures today, then your organization will be ready when the law starts being enforced.
Understanding DPDP penalties helps organisations recognise the financial consequences of failing to protect personal data and follow the required breach notification process.
Key Steps to Take Now
Track Announcements: Be on the lookout for announcements made by MeitY and DPBI on implementation dates in a phased manner.
Adopt Formats: Once you receive the formats, update your internal templates immediately.
Plan Systems in Advance: Create systems before time to make sure that you comply seamlessly once the regulations come into effect.
​
Critical Overlap (The 6-Hour CERT-In Clock): While the DPDP Rules give you a two-stage window for the DPBI, India’s cybersecurity regulator (CERT-In) mandates that cyber incidents and data breaches must also be reported to them within 6 hours of discovery. Your incident response plan must address both timelines simultaneously.
Key takeaways
- Dual Notification Scheme: Inform the DPBI and also the individuals whose data was breached.
- Two-Step Notification Process: Send an initial notice to the DPBI and then a full notification after 72 hours.
- No Breach Size Requirement: Every data breach, irrespective of its size, needs to be notified.
- Proactive Readiness: Make your response plan ready by appointing ownership for different types of notifications and performing drills.
- Digital Personal Data Protection Act, 2023 – India Code
- DPDP Rules, 2025 – MeitY
- CERT-In – Official Website
- DPDP Rules Explanatory Note – MeitY
