Ch IPreliminary
S.1 Short title and commencementS.2 DefinitionsS.3 Application and scopeCh IIObligations of Data Fiduciary
S.4 Grounds for processingS.5 NoticeS.6 ConsentS.7 Certain legitimate usesS.8 Data Fiduciary obligationsS.9 Children’s dataS.10 Significant Data FiduciaryCh IIIRights and duties of Data Principal
S.11 Right to accessS.12 Correction and erasureS.13 Grievance redressalS.14 Right to nominateS.15 Duties of the Data PrincipalCh IVSpecial provisions
S.16 Transfer outside IndiaS.17 ExemptionsCh VData Protection Board of India
S.18 Establishment of the BoardS.19 Composition of the BoardS.20 Salary and term of officeS.21 DisqualificationsS.22 Resignation and vacanciesS.23 Proceedings of the BoardS.24 Officers and employeesS.25 Members as public servantsS.26 Powers of the ChairpersonCh VIBoard powers and procedure
S.27 Powers and functions of the BoardS.28 Procedure followed by the BoardCh VIIAppeal and dispute resolution
S.29 Appeal to the Appellate TribunalS.30 Tribunal orders as a decreeS.31 Alternate dispute resolutionS.32 Voluntary undertakingCh VIIIPenalties
S.33 Penalties and the ScheduleS.34 Penalties to Consolidated FundCh IXMiscellaneous
S.35 Good-faith protectionS.36 Power to call for informationS.37 Blocking of accessS.38 Consistency with other lawsS.39 Bar of jurisdictionS.40 Power to make rulesS.41 Laying of rules before ParliamentS.42 Power to amend the ScheduleS.43 Power to remove difficultiesS.44 Amendments to other ActsObligation
Breach notification is the duty to inform the Data Protection Board and every affected individual when a personal data breach occurs.
TL;DR
Breach notification (Section 8(6)) is a Data Fiduciary's duty to inform both the Data Protection Board and every affected Data Principal when a personal data breach occurs. The form, content and timing are set by the DPDP Rules, so staying silent after a breach is not an option.
In the event of a personal data breach, the Data Fiduciary shall give the Board and each affected Data Principal, intimation of such breach in such form and manner as may be prescribed.
After a breach, silence is not an option. The fiduciary must notify both the Board and each affected Data Principal.
The form, manner and timing are set by the Rules, which detail what the intimation must contain and how quickly it must be sent.
If a database of customers is exposed, the company must tell the Board and each affected customer in the prescribed form.
Who must be told about a breach?
Both the Data Protection Board and each affected Data Principal.
What penalty applies for not notifying?
A breach of the notification duty may attract a penalty that may extend to two hundred crore rupees.
Consultant-led and partner-backed.