Skip to content
Back to Blog
·9 min read·compliance

DPDP Act Data Breach Notification Rules for Indian Businesses

What the DPDP Act 2023 and DPDP Rules 2025 require after a personal data breach: notification timelines to the Board and data principals, and how to prepare.

BR

Bachao.AI Research Team

Cybersecurity Research

Check DPDP Compliance

Compliance risk for Indian SMBs

Non-compliance with the DPDP Act 2023 carries penalties up to ₹250 crore. This post explains what's at stake and what action to take.

Under India's Digital Personal Data Protection Act 2023, any business that processes personal data (a "Data Fiduciary") must intimate both the Data Protection Board of India and every affected individual (a "Data Principal") as soon as it becomes aware of a personal data breach — regardless of the breach's size or severity. The DPDP Rules 2025, notified by MeitY in November 2025, set out a two-stage notification: an initial "without delay" alert followed by a detailed report to the Board within 72 hours. There is no minimum-harm threshold and no exemption for small businesses. These obligations become fully effective 18 months after the Rules were notified, but if you store, collect, or process personal data of Indian residents, you need a documented, testable breach-notification process well before that deadline, not after an incident forces you to build one under pressure.

What Counts as a "Personal Data Breach" Under DPDP

The DPDP Act defines a personal data breach broadly: any unauthorised processing of personal data, or any accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data that compromises its confidentiality, integrity, or availability. This is a deliberately wide net — far more incidents qualify than most founders assume.

It is not limited to a hacker exfiltrating a customer database. Under this definition, a reportable breach includes:

    1. A misconfigured cloud storage bucket that briefly exposed customer records, even if no one is confirmed to have accessed them.
    2. An employee emailing a spreadsheet of user data to the wrong external address.
    3. A third-party vendor or SaaS tool you use suffering a breach that exposes data you gave them.
    4. Ransomware that encrypts (not steals) a database, because it compromises availability.
    5. A lost or stolen laptop, phone, or backup drive containing unencrypted personal data.
    6. An API endpoint returning more user data than intended due to a broken authorisation check (an IDOR-class bug).
⚠️
WARNING
Unlike many global frameworks, the DPDP Act as currently structured does not carve out a materiality or "likely to cause harm" filter before the Board notification obligation is triggered. Every confirmed personal data breach is presumed reportable to the Board. Don't wait to build an internal severity-scoring process before you have a notification workflow — build the workflow first, then layer scoring on top for prioritisation.

Who You Must Notify, and When

The DPDP Act (Section 8(6)) requires Data Fiduciaries to notify both the Data Protection Board of India and each affected Data Principal in the event of a personal data breach. The Digital Personal Data Protection Rules 2025, notified by the Ministry of Electronics and Information Technology (MeitY) in November 2025, spell out the mechanics in more detail than the parent Act.

Notifying the Data Protection Board

Under Rule 7 of the DPDP Rules 2025, Board notification happens in two stages:

  1. Immediate intimation — as soon as the Data Fiduciary becomes aware of the breach, it must inform the Board without delay, describing the nature, extent, and timing of the breach and, where known, the likely impact.
  2. Detailed follow-up report — within 72 hours of becoming aware (extendable in specific circumstances on written request), the Data Fiduciary must submit a fuller report covering the facts and circumstances of the breach, the categories and approximate number of affected Data Principals, mitigation and remedial measures already taken or planned, findings regarding the person responsible where identified, and steps taken to prevent recurrence.
Because the 72-hour clock starts from awareness, not confirmed full scope, your incident response process must produce a credible initial notification long before the forensic investigation is complete.

Notifying Affected Data Principals

The same framework requires the Data Fiduciary to notify affected individuals directly, in clear and plain language, describing:

    1. The nature and extent of the breach.
    2. The likely consequences for the individual.
    3. The measures being taken to mitigate the risk.
    4. A point of contact where the individual can seek further information.
There is no consolidated public "breach registry" exemption — silence is not an option, and notification cannot be delayed to protect brand reputation.
🚨
DANGER
Waiting to notify until you have "the full picture" is one of the most common and costly mistakes in breach response. Both the Board and Data Principal notifications are triggered by awareness of a breach, not by completion of your investigation. Treat the notification clock as running from the moment your team first confirms the incident, not from the day the root cause analysis wraps up.
graph TD A[Detect anomaly or alert] --> B[Contain the incident] B --> C[Assess scope and data affected] C --> D[Notify Data Protection Board] C --> E[Notify affected Data Principals] D --> F[Remediate and harden controls] E --> F classDef normal fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 classDef danger fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 classDef success fill:#1e3d2f,stroke:#10B981,color:#e2e8f0 class A,B normal class C danger class D,E danger class F success

Documentation the Board Will Expect

A notification is only as credible as the evidence behind it. Businesses that treat documentation as an afterthought consistently miss the 72-hour follow-up deadline. At minimum, your incident record should capture:

Documentation itemWhy it matters
Timeline of detection, containment, and escalationEstablishes when "awareness" began, which starts the notification clock
Systems and data categories affectedRequired for both Board and Data Principal notifications
Approximate number of Data Principals impactedExplicitly required in the detailed Board report
Root cause and responsible vector (if known)Required field in the detailed follow-up report
Mitigation steps already takenDemonstrates active response, not passive disclosure
Preventive measures plannedSignals the Board that recurrence risk is being addressed
Internal sign-off trail (who approved what, when)Evidence of governance if the Board asks follow-up questions
💡
TIP
Build a breach-notification template before you need it, with placeholder fields mapped directly to what the DPDP Rules require. During an actual incident, your team should be filling in blanks under a clock, not deciding from scratch what the report needs to contain.

Know your vulnerabilities before attackers do

Run a free VAPT scan — takes 5 minutes, no signup required.

Book Your Free Scan

Common Root Causes You Should Be Monitoring For

Most reportable breaches trace back to a small number of recurring failure modes. Knowing where your exposure concentrates helps you prioritise detection and prevention effort instead of spreading it evenly across every theoretical risk.

pie title Common Personal Data Breach Root Causes "Misconfigured cloud storage or access controls" : 28 "Phishing and credential compromise" : 24 "Third-party or vendor breach" : 18 "Unpatched software vulnerabilities" : 15 "Lost or stolen devices" : 9 "Insider error or misuse" : 6
Up to 250 CrMaximum penalty under the DPDP Act's Schedule for failure to implement reasonable security safeguards (MeitY, DPDP Act 2023)
6 hoursWindow CERT-In mandates for reporting specified categories of cyber incidents (CERT-In Directions under Section 70B, 2022)
200+ daysGlobal average time organisations take to identify and contain a data breach (IBM Cost of a Data Breach Report)

Note that DPDP breach notification and CERT-In's separate 6-hour cyber-incident reporting mandate are not the same obligation — a single incident can trigger both, and your process needs to satisfy each on its own timeline.

Building a Notification-Ready Incident Response Process

You cannot assemble a compliant breach response after the breach has already happened. Organisations that meet DPDP timelines comfortably treat notification readiness as a standing capability, not a one-time compliance project.

1. Define "awareness" internally, in writing

Decide in advance what counts as your organisation becoming "aware" of a breach — a confirmed alert, a credible customer report, a vendor's disclosure — and write it down. This single decision determines when your regulatory clock starts, and it should not be improvised mid-incident.

2. Pre-build your notification templates

Draft the initial Board intimation and the Data Principal notice as templates now, with every required field mapped to a data source in your systems (logs, asset inventory, customer database schema). This is the single highest-leverage step, since it turns a 72-hour scramble into a fill-in-the-blanks exercise.

3. Maintain a current data inventory

You cannot describe "the categories and approximate number of affected Data Principals" if you do not already know what personal data you hold, where it lives, and which systems process it. A living data-flow map is a prerequisite for fast, accurate notification — not a nice-to-have.

4. Assign clear incident-response roles

Name who declares an incident, who leads containment, who owns regulator communication, and who owns customer communication. Ambiguity about ownership is one of the most common reasons notification deadlines slip.

5. Test the process before you need it

Run a tabletop exercise simulating a realistic breach scenario — a leaked API key, a phished admin account, a vendor incident — and time how long it actually takes your team to produce a Board-ready notification. If it takes longer than 72 hours in a drill with no real pressure, it will take even longer during an actual incident.

6. Close the loop with vendor and third-party breaches

Your DPDP obligations do not stop at your own infrastructure. If a vendor processing personal data on your behalf suffers a breach, you as the Data Fiduciary remain responsible for notifying the Board and your Data Principals. Contractual clauses requiring vendors to notify you immediately are essential, not boilerplate.

🛡️
SECURITY
A breach-notification process is only as strong as the detection capability feeding it. If you cannot reliably detect misconfigurations, exposed credentials, and vulnerable endpoints in the first place, you will find out about breaches from customers, journalists, or the Data Protection Board — not from your own monitoring. Regular vulnerability assessment and penetration testing closes this gap by surfacing the exposures before they become incidents.

Bachao.AI, built by Dhisattva AI Pvt Ltd, runs continuous automated VAPT scans specifically to catch the misconfigurations, exposed endpoints, and vulnerable dependencies that most commonly turn into reportable personal data breaches — before an attacker or a regulator finds them first. Where CERT-In empanelment is a formal requirement for a specific engagement, that work is delivered with a CERT-In empanelled partner.

DPDP Compliance Beyond Breach Notification

Breach notification is a downstream obligation — it only becomes relevant once a breach has already happened. The upstream work covers consent management, data minimisation, purpose limitation, data principal rights (access, correction, erasure), and reasonable security safeguards under Section 8(5), which is what keeps you off the safeguard-failure penalty track in the first place. If you need a structured way to assess and close these gaps, see Bachao.AI's DPDP compliance offering.

🎯Key Takeaway
DPDP breach notification is a two-clock obligation — intimate the Data Protection Board without delay, then follow up with a detailed report within 72 hours, and notify every affected Data Principal directly. There is no severity threshold and no small-business exemption. The only way to reliably hit both clocks is to pre-build your documentation templates, data inventory, and incident-response roles before a breach happens, not during one.

Frequently Asked Questions

Frequently Asked Questions

Does the DPDP Act apply to a small business with only a handful of customers?
Yes. The DPDP Act does not carve out an exemption based on company size or the number of Data Principals whose data you process. If you collect or process personal data of individuals in India, the breach notification obligations apply regardless of your organisation's scale.
What is the deadline to notify the Data Protection Board after a breach?
The DPDP Rules 2025, notified by MeitY in November 2025, set out an initial intimation to the Board without delay upon becoming aware of the breach, followed by a more detailed report within 72 hours, with limited scope for extension on written request. Treat 72 hours as the working benchmark to build toward now, ahead of the Rules' phased effective date.
Is a ransomware attack that encrypts data but does not steal it a reportable breach?
Yes. The DPDP Act's definition of a personal data breach includes any compromise of confidentiality, integrity, or availability of personal data. Encryption by ransomware compromises availability, which is enough to trigger the notification obligation even without confirmed data exfiltration.
Do we need to notify customers even if we believe the risk of harm is low?
The DPDP Act's notification obligation to the Board is not conditioned on a harm or materiality threshold, and the DPDP Rules extend a similar direct-notification expectation to affected Data Principals. Treat every confirmed personal data breach as reportable unless legal counsel advises otherwise on your specific facts.
How is DPDP breach notification different from CERT-In's 6-hour reporting requirement?
They are separate obligations that can both apply to the same incident. CERT-In's Directions under Section 70B require reporting of specified categories of cyber security incidents within 6 hours of noticing them, while DPDP notification is specifically about personal data breaches and follows its own timeline to the Data Protection Board and affected individuals. Your incident response process needs to satisfy both independently.
What happens if we fail to notify on time?
The DPDP Act empowers the Data Protection Board to levy financial penalties for non-compliance. Failure to notify the Board or affected Data Principals sits in its own penalty tier under the Act's Schedule, separate from and lower than the ceiling for failing to implement reasonable security safeguards in the first place. The exact amount depends on the nature and severity of the violation as determined by the Board.

Get Ahead of Your Next Incident

The gap between "we have a written policy" and "we can produce a Board-ready notification inside 72 hours" is where most Indian businesses lose. Close it before an incident forces the question. Start with a free VAPT scan to find the exposures most likely to become a reportable breach, and browse the Bachao.AI blog for more DPDP guidance.

BR

Bachao.AI Research Team

Cybersecurity Research

AI-powered security research and threat intelligence from the Bachao.AI team. Covering the latest vulnerabilities, CVEs, and cybersecurity developments affecting Indian businesses.

Get cybersecurity insights for Indian SMBs

Weekly vulnerability alerts, DPDP compliance tips, and security guides. No spam — unsubscribe anytime.

We respect your privacy. Your email is never shared.

See if your business is DPDP Act compliant

Free automated scan — risk score in under 2 hours. No credit card required.

Check DPDP Compliance
Find your vulnerabilitiesStart free scan →