Data Breach Response Under the DPDP Act: What Businesses Should Prepare For

Hero Summary

Under India's Digital Personal Data Protection (DPDP) Act, 2023, a data fiduciary that suffers a personal data breach must notify the Data Protection Board of India and each affected individual. The DPDP Rules, 2025, notified on 14 November 2025, require affected individuals to be told without delay, in plain language, what happened, the possible impact, what has been done about it, and who to contact. Failing to notify can attract penalties of up to ₹200 crore. Most obligations apply after an eighteen-month phase-in period, so the time to build a breach response capability is now.

Executive Summary

A breach response is a set of decisions made quickly under pressure: what happened, whose data is affected, who must be told, and what to do about it. Under the DPDP framework, those decisions have legal consequences. This guide explains what counts as a personal data breach, who must be notified and what the notice must say, how DPDP interacts with other reporting duties such as CERT-In's six-hour rule and sector regulators, and how to build a practical response plan. Because the Rules set detailed timelines and formats that readers should confirm in the official text, this guide points to the primary sources and flags where to check.

What counts as a personal data breach? {#what-is-breach}

The DPDP Act defines a personal data breach as any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data, that compromises its confidentiality, integrity, or availability. That is broader than a hacker stealing a database: it includes a misdirected email that exposes personal data, a lost unencrypted device, an employee viewing records without authorization, and ransomware that makes data unavailable. Under the Act, the data fiduciary — the organization that decides why and how personal data is processed — is responsible, including for data held by processors acting on its behalf.

Who must be notified {#notify}

The Act requires a data fiduciary to notify the Data Protection Board of India and each affected data principal of a personal data breach, in the form and manner prescribed by the Rules. The Data Protection Board is the independent, digital-first body set up under the Act to oversee compliance and inquire into breaches; the Rules provide for a four-member Board with online complaint filing, and appeals against its decisions go to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

The Rules prescribe the detail of reporting to the Board, including timing and content. Confirm the current requirements in the Gazette text of the DPDP Rules, 2025, rather than relying on summaries.

What the notice to individuals must contain {#notice}

According to the Government of India's official explainer on the Rules, when a breach takes place the data fiduciary must inform all affected individuals without delay. The message must be in plain language and must explain:

• what happened,
• the possible impact on the individual,
• the steps taken to address the issue, and
• contact details for help.

The government's guidance also stresses that individuals must be informed at the earliest so they can act quickly to reduce harm, such as changing passwords or watching for fraud.

Penalties {#penalties}

Under the Act, as summarized by the Government of India:

• Failing to maintain reasonable security safeguards can attract penalties of up to ₹250 crore.
• Failing to notify the Board or affected individuals of a personal data breach can attract penalties of up to ₹200 crore.
• Other violations of the Act or Rules by a data fiduciary can attract penalties of up to ₹50 crore.

These are maximums, set by the Board after an inquiry, and the penalty for a breach can combine the failure to prevent it with the failure to report it.

When the obligations apply {#timing}

The Rules were notified on 14 November 2025 and introduce an eighteen-month period for phased compliance. In practice, this places the main data fiduciary obligations — including breach notification — around May 2027, with some provisions, such as those establishing the Data Protection Board, taking effect earlier. Confirm exact commencement dates in the official notification. Preparing a breach response capability takes months, so starting now is sensible.

Other reporting duties that apply at the same time {#other}

DPDP is one of several overlapping obligations:

• CERT-In. CERT-In's April 2022 directions require covered entities to report specified cyber incidents to CERT-In within six hours of noticing them, and to keep system logs for 180 days.
• Sector regulators. Banks, financial institutions, insurers, and market participants have their own incident-reporting duties. See Cyberattacks on Indian Banks and SEBI CSCRF and VAPT.
• Contracts. Customer and vendor contracts frequently require notification within set periods.
• Law enforcement and insurers, where applicable.

A response plan should map every one of these and assign who sends each notice, so they are consistent and nothing is missed.

Building a breach response plan {#plan}

1. Know your data. You cannot assess a breach without knowing what personal data you hold, where it lives, and which systems and processors touch it. A current data inventory is the foundation. See What Is DPDP? for the wider DPDP picture.
2. Define what triggers the plan — what counts as a suspected breach and who can declare an incident.
3. Assign roles — an incident lead, legal and privacy, technical response, communications, and an executive decision-maker, with deputies.
4. Prepare notification templates for the Board, affected individuals, CERT-In, regulators, and customers, so notices are written before the crisis.
5. Put processors under contract to notify you promptly of any breach affecting your data and to cooperate in investigation.
6. Keep logs and evidence so you can establish what happened and show the Board what you did.
7. Maintain a published point of contact for privacy queries; the Rules require data fiduciaries to publish contact details for questions about personal data.
8. Rehearse. Run a tabletop exercise at least once a year and update the plan after each exercise or real incident.

What to do when a breach happens {#response}

1. Detect and declare the incident and start the clock for each reporting duty.
2. Contain it — isolate affected systems, revoke compromised credentials, and stop ongoing data loss.
3. Preserve evidence before systems are rebuilt or wiped.
4. Assess the data types involved, the number of individuals affected, the likely harm, and whether the breach is still ongoing.
5. Notify the Data Protection Board, affected individuals, CERT-In, and any sector regulator according to the applicable requirements.
6. Remediate the cause and support affected individuals.
7. Review what went wrong, update controls and the plan, and record the decisions made.

How Threat ResQ fits {#threat-resq-fit}

• PrivacyIQ, Threat ResQ's privacy management platform, maintains a data inventory and provides an incident register alongside technical discovery and DPDP readiness views. It is a platform that supports a privacy programme: it is not a certifying authority and does not grant or imply a "DPDP compliant" status.
• SOC+ provides 24x7 monitoring and alert triage by a live analyst team, which shortens the time to detect a breach, and logs incidents and their resolution as compliance evidence for getTRAC.
• Threat ResQ's Incident Response service provides on-call containment, forensic investigation, and recovery support, and Compliance Consulting supports regulatory readiness.

FAQ {#faq}

Who must be notified of a personal data breach under DPDP? The Data Protection Board of India and each affected data principal. The Rules prescribe the form and timing of the notices.

What must the notice to affected individuals say? According to the Government of India's explainer on the Rules, it must be in plain language and explain what happened, the possible impact, the steps taken to address it, and contact details for help, and affected individuals must be told without delay.

What is the penalty for not reporting a breach? Failing to notify the Board or affected individuals can attract penalties of up to ₹200 crore. Failing to maintain reasonable security safeguards can attract up to ₹250 crore.

When do the DPDP breach notification duties start? The Rules, notified on 14 November 2025, provide an eighteen-month phase-in for most obligations, which places them around May 2027. Confirm exact dates in the official notification.

Do I also have to report to CERT-In? If you are a covered entity and the incident is one of the specified types, CERT-In's April 2022 directions require reporting within six hours of noticing it. This applies in addition to DPDP duties.