Under DPDP Rule 7, a business that suffers a personal data breach must inform each affected individual and the Data Protection Board without delay, and send the Board a detailed report within 72 hours of becoming aware of it (or a longer period the Board allows). There is no harm threshold: every personal data breach must be reported. Not reporting can attract a penalty of up to ₹200 crore.
- Tell affected people
- Without delay
- Tell the Board
- Without delay, details within 72 hours
- CERT-In (cyber incidents)
- Within 6 hours
- Penalty for not reporting
- Up to ₹200 crore
What counts as a personal data breach
Any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability. A misdirected email with a customer list, a lost laptop, a hacked CRM and ransomware that locks records all count.
Who to tell, and what to say
| To whom | When | What |
|---|---|---|
| Each affected individual | Without delay | What happened, likely consequences, steps taken and safety measures they can take, and a contact person |
| Data Protection Board | Without delay (first intimation) | Description of the breach: nature, extent, timing, location and likely impact |
| Data Protection Board | Within 72 hours (or longer if allowed) | Detailed report: facts, cause, mitigation, any findings about who caused it, remedial steps, and the intimations sent to individuals |
| CERT-In (if a reportable cyber incident) | Within 6 hours of noticing | Incident report under the CERT-In Directions of 28 April 2022 |
A 72-hour playbook
- Hour 0: contain the breach and preserve logs.
- Hours 0–6: assess whether it is a cyber incident reportable to CERT-In, and report if so.
- Hours 0–24: send the first intimation to the Board; start notifying affected people.
- Hours 24–72: investigate cause and scope, then file the detailed report with the Board.
- Afterwards: fix the root cause and record lessons learnt.
Processors must report breaches to you quickly, so put a short deadline (for example 24 hours) in every vendor contract.
Frequently asked questions
Is there a minimum threshold for reporting a breach under DPDP?
No. Unlike the EU GDPR, the DPDP Act requires every personal data breach to be reported to the Board and affected individuals, regardless of risk level.
Does the processor or the business report the breach?
The Data Fiduciary (the business) is responsible for reporting, even if the breach happened at its processor. The processor should report to the business under their contract.
Is the 72-hour DPDP deadline in force?
The breach reporting duty under Rule 7 applies from 13 May 2027. CERT-In's 6-hour reporting for cyber incidents already applies.
More DPDP Act guides
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- Does the DPDP Act apply to my business?
- DPDP Act penalties
- Consent and privacy notice under DPDP
- Significant Data Fiduciary (SDF)
- Data Protection Officer (DPO) under DPDP
- Children's data and parental consent
- DPDP Act vs GDPR
- DPDP and marketing (email, WhatsApp, calls)
- Employee and HR data under DPDP
- Data Principal rights and requests
- Data retention and erasure under DPDP
- Cross-border data transfer under DPDP
- DPDP compliance cost in India
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.