Breach response

DPDP Data Breach Notification: The 72-Hour Rule

By Kaivan Tech · Published 4 November 2026 · Updated 4 November 2026 · Checked against the official Act and Rules

Short answer

Under Rule 7 of the DPDP Rules, 2025, a business that becomes aware of a personal data breach must inform each affected person without delay, send the Data Protection Board an immediate description of the breach, and file a detailed report with the Board within 72 hours, unless the Board allows more time on a written request.

Tell affected people: Without delay, through their user account or registered contact
Tell the Board (first): Without delay: nature, extent, timing, location and likely impact
Tell the Board (detailed): Within 72 hours of becoming aware
Penalty for not reporting: Up to ₹200 crore (Section 8(6))

What you must tell affected individuals

Rule 7(1) requires a concise, clear and plain notice to each affected Data Principal, sent through their user account or any contact method they registered with you. It must cover:

A description of the breach, including its nature, extent and timing
The consequences likely to affect that person
The measures you have taken or are taking to reduce the risk
Safety steps the person can take to protect themselves
Contact details of someone who can answer their questions

What you must report to the Data Protection Board

Rule 7(2) sets two stages. First, without delay, a description of the breach: its nature, extent, timing, location and likely impact. Then, within 72 hours of becoming aware of it, a detailed report containing:

Updated and detailed information about the breach
The broad facts and circumstances that led to it
Mitigation measures taken or proposed
Any findings about who caused the breach
Remedial steps to stop it happening again
A report on the notices sent to affected individuals

DPDP vs CERT-In: two different clocks

DPDP breach reporting does not replace CERT-In’s directions. Under CERT-In’s April 2022 directions, specified cyber incidents must be reported to CERT-In within 6 hours of noticing them. A ransomware attack on a customer database can trigger both: CERT-In in 6 hours, the Data Protection Board in 72 hours, and the affected customers without delay.

Breach reporting timelines in India
Who to notify	Deadline	Source
CERT-In (cyber incidents)	6 hours	CERT-In directions, 2022
Affected Data Principals	Without delay	DPDP Rule 7(1)
Data Protection Board: initial intimation	Without delay	DPDP Rule 7(2)(a)
Data Protection Board: detailed report	72 hours	DPDP Rule 7(2)(b)

How to be ready before a breach happens

Keep access logs for at least one year, as Rule 6 requires, so you can tell what was accessed
Know where personal data lives: a data inventory makes the “extent” question answerable in hours, not weeks
Pre-draft the individual notice and the Board report, with owners for each section
Make sure you can actually message every user, through accounts or registered contact details
Require vendors and processors to tell you about breaches fast enough to meet your own clock

Need this done in your own systems?

Kaivan Tech assesses websites, apps and business systems against the DPDP Act and Rules, then implements the fixes: consent and notice flows, rights workflows, logging, retention and breach readiness.

See our DPDP compliance services

Frequently asked questions

What is the breach notification time under the DPDP Act?+

Under Rule 7 of the DPDP Rules, 2025, affected individuals and the Data Protection Board must be informed without delay, and a detailed report must reach the Board within 72 hours of the business becoming aware of the breach.

Does every personal data breach have to be reported under DPDP?+

Yes. Unlike GDPR, the DPDP Act has no risk threshold for notification: Section 8(6) requires intimation of a personal data breach to the Board and to each affected Data Principal.

Can the 72-hour deadline be extended?+

Yes. Rule 7(2)(b) allows a longer period if the Board permits it on a written request from the Data Fiduciary.

What is the penalty for not reporting a data breach in India?+

Failing to notify the Board or affected individuals of a personal data breach can attract a penalty of up to ₹200 crore under the Schedule to the DPDP Act, 2023.

Do I still need to report to CERT-In?+

Yes. CERT-In’s 6-hour reporting requirement for specified cyber incidents applies separately from DPDP breach intimation.

Related DPDP guides

Sources

This guide explains the law in general terms and is not legal advice. Have a qualified Indian legal professional confirm how the Act and Rules apply to your organisation.