DPDP breach notification: the Board, users and 72 hours
Reviewed against the law as of 28 September 2026
Every personal data breach must be reported to the Data Protection Board and each affected person. What to send, when, and how CERT-In fits in.
Section 8(6) of the DPDP Act says that when a personal data breach happens, the Data Fiduciary must give intimation to the Data Protection Board and to each affected Data Principal. The DPDP Rules, 2025 set out how. Failing to notify can attract a penalty of up to ₹200 crore, separate from the up to ₹250 crore for failing to take reasonable security safeguards in the first place.
What counts as a breach
The Act defines a personal data breach broadly: any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability. That includes:
- a customer export left in a publicly readable bucket, even if you cannot prove anyone downloaded it;
- ransomware that encrypts a database of customer records, even if nothing was copied;
- an e-mail with a spreadsheet of employee data sent to the wrong recipient;
- a processor's compromise that exposes your customers' data.
There is no materiality or risk threshold. That is a significant difference from GDPR.
Telling affected people
The Rules require you to inform each affected Data Principal without delay, through their user account or the contact details you hold, in clear and plain language. The message should cover:
- what happened: the nature, extent, timing and location of the breach;
- the likely consequences for them;
- what you have done and are doing to mitigate the risk;
- what they can do to protect themselves;
- a business contact who can answer their questions.
Telling the Data Protection Board
Reporting to the Board has two stages:
- Without delay: an initial intimation describing the breach, including its nature, extent, timing, location and likely impact.
- Within 72 hours of becoming aware of it, or a longer period if the Board allows on request: a detailed report with the facts and circumstances, the reasons, the mitigation measures, any findings about the person who caused it, the remedial steps to prevent recurrence, and a report of the intimations sent to affected people.
The Board is designed to be digital-first, with reporting and complaints handled online.
How CERT-In fits in
The CERT-In Directions of April 2022 list data breaches and data leaks among the cyber incidents that must be reported to CERT-In within six hours of noticing them. One incident can therefore trigger three clocks:
| Recipient | Deadline | Basis |
|---|---|---|
| CERT-In | 6 hours from noticing | CERT-In Directions, 2022 |
| Data Protection Board, initial | Without delay | DPDP Act section 8(6) and Rules |
| Data Protection Board, detailed | 72 hours from awareness | DPDP Rules |
| Affected Data Principals | Without delay | DPDP Act section 8(6) and Rules |
Sector regulators such as the RBI, SEBI or IRDAI may add their own reporting duties.
Getting ready before it happens
Seventy-two hours is short when you do not know which systems hold what. Prepare now:
- Know your data. An up-to-date inventory tells you within minutes whether an affected system holds personal data, whose, and how many records.
- Keep logs. You cannot state the extent and timing of a breach without logs. The Rules require logs to be kept for at least a year; CERT-In requires 180 days within India.
- Write the playbook. Who decides that an event is a breach, who drafts the notices, who approves them, how messages reach users.
- Pre-draft templates. Board intimation, detailed report and user notice, in the languages your users read.
- Bind processors. Contracts should require immediate notice to you with the facts you will need.
- Rehearse. A tabletop exercise will expose missing contacts and approvals.
How TrustNiq helps
TrustNiq starts the CERT-In and DPDP clocks when an incident is recorded, uses the data inventory to show which personal data and people are affected, and prepares draft CERT-In and DPDP reports from what it already knows, for a person to check and send. See how it works.
Frequently asked questions
Is there a threshold below which a breach need not be reported under DPDP?
No. Unlike GDPR, the DPDP Act does not limit notification to breaches likely to cause harm. Every personal data breach must be intimated to the Board and to each affected Data Principal.
What counts as a personal data breach?
Any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to it, that compromises its confidentiality, integrity or availability.
Do we also have to report to CERT-In?
If the incident is a reportable cyber incident under the CERT-In Directions, such as a data breach or data leak, yes: to CERT-In within six hours of noticing it, in addition to the DPDP notifications.
Who reports a breach at our processor?
The Data Fiduciary remains responsible, so your contracts should require processors to tell you immediately. You then notify the Board and affected people.
Sources
- Digital Personal Data Protection Act, 2023, section 8(6) and the Schedulemeity.gov.in
- Digital Personal Data Protection Rules, 2025meity.gov.in
- PIB: DPDP Rules, 2025 notifiedstatic.pib.gov.in
- CERT-In Directions, 28 April 2022cert-in.org.in
This article is general information about Indian law as published at the date above, written to help organisations plan their compliance work. It is not legal advice. Check the official text and take advice on your own facts.