Breach Notification (Regulator)
Plain English Translation
Under Section 8(6) of the Act, if a security incident compromises personal data, you must execute a specific DPDP breach notification procedure to inform the Data Protection Board of India. Unlike some laws that only require reporting significant harm, this Act requires data breach reporting India for any personal data breach, defined broadly as any unauthorized processing, accidental disclosure, or loss of access. You must provide this intimation in the prescribed form and manner, which draft rules suggest includes an initial report without delay followed by a detailed report within 72 hours.
Technical Implementation
Use the tabs below to select your organization size.
Required Actions (startup)
- Create an Incident Response Plan from a template in WatchDog Security's Free Policy Manager
- Assign a specific person to be the point of contact for the Data Protection Board.
- Maintain a manual log of all security incidents.
Required Actions (scaleup)
- Maintain pre-approved regulator notification templates and an IR runbook in a controlled policy system (e.g., WatchDog Policy Management) with version history and approval traceability.
- Conduct quarterly mock breach drills.
- Pre-draft legal templates for breach notification.
Required Actions (enterprise)
- Real-time API integration with the Board's digital office (once available) for breach notification timeline India compliance.
- AI-driven impact analysis to instantly quantify affected users.
- 24/7 legal and forensic retainer for immediate breach response.
Under Section 8(6), a breach must be reported. Draft Rule 7 clarifies this must be done 'without delay' for the initial intimation, followed by a detailed report within 72 hours.
Section 2(u) defines a 'personal data breach' as any unauthorized processing, accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data.
Draft rules suggest the report must include the nature, extent, and time of the breach, likely impact, risk mitigation measures, and details of the Data Protection Officer.
Yes, while the Act says 'as prescribed', draft Rule 7 specifies reporting 'without delay' and submitting a comprehensive updated report within 72 hours.
Section 8(6) explicitly places the responsibility on the Data Fiduciary to give intimation of the breach to the Board and the affected Data Principal.
The Board is expected to function as a digital office (Section 28). Reporting will likely be through an online portal or digital form as prescribed by the rules.
Failure to report a breach to the Board or Data Principal can attract a penalty extending to two hundred crore rupees under Schedule (2) of the Act.
If the incident meets the definition of 'personal data breach' under Section 2(u)—which encompasses unauthorized processing, disclosure, or loss of access—it must be reported, regardless of harm.
| Version | Date | Author | Description |
|---|---|---|---|
| 1.0.0 | 2026-02-08 | WatchDog Security GRC Wiki Team | Initial publication from DPDP Workbook |
