DPDP Act Data Breach Notification: India 72-Hour Guide

Under the Digital Personal Data Protection Act 2023, Indian companies that experience a personal data breach must notify the Data Protection Board of India and each affected Data Principal without delay. The Act does not prescribe a fixed 72-hour window for the Board notification — the Rules (once notified) will specify the timeline — but CERT-In's separate directive already mandates reporting cybersecurity incidents within six hours. In practice, your first 72 hours after breach detection are the most consequential: the decisions you make (and document) during this window determine legal exposure, regulatory penalty, and reputational outcome.

This guide walks compliance leads, CTOs, and founders through the obligations, the assessment logic, the documentation requirements, and the overlap with CERT-In's faster-moving reporting mandate.

What Counts as a Personal Data Breach Under DPDP Act 2023

The DPDP Act 2023 defines a personal data breach as any unauthorized processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data. Critically, the Act's scope is personal data processed in digital form — or data collected offline but subsequently digitised.

Not every IT incident qualifies. A server going down, a misconfigured dashboard that exposed no actual data, or an internal access to data within approved purpose — none of these automatically triggers the breach-notification obligation. What matters is whether personal data was exposed or could have been accessed by an unauthorized party.

Key indicators that you have a notifiable breach:

1. Credentials or identity records of customers, employees, or users were accessed without authorization
2. Ransomware encrypted or exfiltrated records containing personal data
3. An employee shared a customer database with an external party without approval
4. A third-party vendor suffered a breach that included your data you shared with them
5. An API or web application exposed personal data fields to unauthenticated requests

The Two Notification Obligations: DPDP Board vs. CERT-In

Indian companies face two distinct reporting obligations that can run simultaneously after a breach. Understanding which is which prevents dangerous confusion.

Source references: CERT-In Directions April 2022 | MeitY DPDP Act resources

Breach Detection to Notification: Decision Flow

graph TD
    A[Breach Detected or Suspected] --> B{Personal data involved?}
    B -->|No| C[IT Incident Only — internal IR process]
    B -->|Yes| D{Unauthorized access confirmed or cannot be ruled out?}
    D -->|Cannot rule out| E[Treat as notifiable — begin documentation]
    D -->|Confirmed breach| E
    D -->|Ruled out| F[Document findings and close]
    E --> G{CERT-In reportable incident type?}
    G -->|Yes| H[File CERT-In report within 6 hours]
    G -->|No or unclear| I[Escalate to legal counsel]
    H --> J[Assess scope — number of Data Principals affected]
    I --> J
    J --> K[Prepare Data Protection Board notification]
    K --> L[Notify affected Data Principals without undue delay]
    L --> M[Preserve all evidence and IR logs]
    M --> N[Remediate and post-incident review]

    style A fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
    style B fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style C fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
    style D fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style E fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
    style F fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
    style G fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style H fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
    style I fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style J fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style K fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style L fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style M fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
    style N fill:#1e3d2f,stroke:#10B981,color:#e2e8f0

What to Document From Hour Zero

Regulators and courts look at two things after a breach: what happened, and what you did about it. Your documentation during the first 72 hours is your evidence trail. Poor documentation has cost companies far more in regulatory scrutiny than the breach itself.

Immediate documentation (within first 6 hours)

1. Detection timestamp — exact date and time when the breach was first identified, and by whom
2. Initial indicators — alert, log anomaly, external report, or other trigger
3. Systems involved — which servers, databases, applications, or third-party services
4. Likely data categories — names, contact details, financial data, health data, government IDs
5. Estimated number of Data Principals — even a rough range is better than nothing
6. Containment actions taken — credentials rotated, system isolated, access revoked

Ongoing documentation (hours 6–72)

1. Forensic investigation log — timestamped entries of every finding, hypothesis tested, and conclusion
2. Chain of custody for disk images, log files, and memory captures
3. Communications log — every internal and external communication related to the breach, with timestamps
4. Notification drafts — preserve each draft of the Board notification and Data Principal notices, with revision history
5. Remediation decisions — what was patched, reconfigured, or shut down, and when

Notifying Affected Data Principals

The DPDP Act places an explicit obligation on Data Fiduciaries (companies that collect and process personal data) to inform each affected Data Principal about the breach. The notification must cover:

1. The nature of the personal data involved
2. The steps the Data Principal can take to protect themselves
3. The safeguards the company has applied or is applying
4. Contact information for the company's point of contact for breach-related queries

Breach Response Timeline: Where Most Incidents Fall Apart

xychart-beta
    title "Typical Breach Response: Hours Elapsed vs Actions Completed"
    x-axis ["Hour 1", "Hour 6", "Hour 24", "Hour 48", "Hour 72"]
    y-axis "Cumulative Actions Completed" 0 --> 10
    bar [1, 3, 5, 7, 9]
    line [2, 5, 7, 9, 10]

The gap between the bar (actual) and line (target) represents the compliance deficit most Indian SMBs face: detection and containment happen, but documentation, formal notification drafting, and Data Principal communication lag behind by 24–48 hours. Closing that gap requires a pre-written incident response runbook, not improvisation.

The 72-Hour Incident Response Checklist

Hour 0–6: Detect and Contain

Hour 6–24: Assess and Escalate

Hour 24–72: Notify and Remediate

Sector Overlay: Additional Reporting for Regulated Industries

If your company operates in a regulated sector, you face parallel notification requirements beyond the DPDP Act and CERT-In.

1. Banking and NBFCs — RBI's cybersecurity framework requires prompt notification of major cyber incidents to the Reserve Bank. Contact: rbi.org.in
2. Stock brokers, depositories, AMCs — SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) mandates incident reporting. Contact: sebi.gov.in
3. Insurance — IRDAI guidelines require incident reporting and include breach notification obligations

Where Bachao.AI Fits

Breach notification obligations are reactive. The stronger posture is preventing the breach in the first place — and catching vulnerabilities before attackers do. Bachao.AI, built by Dhisattva AI Pvt Ltd, automates vulnerability assessment across your web applications and APIs, producing findings that map directly to the kind of controls that prevent unauthorized access to personal data.

A free VAPT scan takes minutes to initiate and surfaces the misconfigurations — exposed APIs, authentication weaknesses, unencrypted sensitive fields — that convert a near-miss into a notifiable breach. For companies with specific DPDP compliance requirements, see the DPDP compliance page.