Obligation
Breach notification is the duty to inform the Data Protection Board and every affected individual when a personal data breach occurs.
In the event of a personal data breach, the Data Fiduciary shall give the Board and each affected Data Principal, intimation of such breach in such form and manner as may be prescribed.
After a breach, silence is not an option. The fiduciary must notify both the Board and each affected Data Principal.
The form, manner and timing are set by the Rules, which detail what the intimation must contain and how quickly it must be sent.
If a database of customers is exposed, the company must tell the Board and each affected customer in the prescribed form.
Who must be told about a breach?
Both the Data Protection Board and each affected Data Principal.
What penalty applies for not notifying?
A breach of the notification duty may attract a penalty that may extend to two hundred crore rupees.