Guide

The DPDP Act data breach notification rule, explained (Section 8, Rule 7)

What counts as a personal data breach under the DPDP Act, who you must notify and how fast, the ₹200 crore penalty band, and a first-hours response checklist.

A personal data breach under the DPDP Act is not only a hack, it includes any unauthorised access, disclosure, or loss of personal data. Section 8 obligations and Rule 7 of the DPDP Rules, 2025 require you to notify both the affected people and the Data Protection Board, and there is a tight reporting window. Here is the shape of a plan that meets it.

What the rule requires

On becoming aware of a breach, a Data Fiduciary must inform each affected Data Principal in plain language, what happened, likely consequences, and what you are doing, and report to the Board, with a detailed follow-up report inside the prescribed window. The penalty band for failing to report a breach reaches ₹200 crore, which is why this is a board-level plan, not an afterthought.

A first-hours checklist

BREACH RESPONSE: first hours
[ ] Detect & contain; freeze affected systems.
[ ] Assess scope: what data, how many principals.
[ ] Notify each affected Data Principal (plain language).
[ ] Notify the Data Protection Board without delay.
[ ] File the detailed report within the required window.
[ ] Log everything: timeline, decisions, comms.

The single biggest determinant of how a breach goes is whether this plan existed before the breach. Write it, name an owner, and rehearse it once. The report-a-data-breach workflow has the full sequence.

What good preparation looks like

Frequently asked questions

Guidance, not legal advice. dpdpactindia.in is an independent resource, not affiliated with the Government of India. Confirm specifics against the enacted Act and Rules.