Personal data breach intimation under the DPDP Act: who you tell, what you say, and when

When a company learns of a personal data breach, Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules, 2025 require it to tell two audiences: each affected person and the Data Protection Board of India. There are two clocks. Both audiences get a first intimation without delay; the Board then gets a detailed report within 72 hours of the company becoming aware (Rule 7(2)(b)). The duty applies to every Data Fiduciary, whatever its size, from 13 May 2027 (Rule 1(4)).

Part of the DPDPA checklist for small companies. This page explains the law; for the engineering, read DPDPA breach notification automation.

What does the law say about breach notification?

The Act sets the duty and leaves the detail to the Rules:

In the event of a personal data breach, the Data Fiduciary shall give the Board and each affected Data Principal, intimation of such breach in such form and manner as may be prescribed.

— Digital Personal Data Protection Act, 2023, Section 8(6)

What counts as a personal data breach:

“personal data breach” means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data;

— Digital Personal Data Protection Act, 2023, Section 2(u)

The Rules then set out the two intimations. To each affected person:

On becoming aware of any personal data breach, the Data Fiduciary shall, to the best of its knowledge, intimate to each affected Data Principal, in a concise, clear and plain manner and without delay, through her user account or any mode of communication registered by her with the Data Fiduciary,—

— Digital Personal Data Protection Rules, 2025, Rule 7(1)

Rule 7(1) goes on to list five items that message must carry, set out below. To the Board, in two stages:

On becoming aware of any personal data breach, the Data Fiduciary shall intimate to the Board,—

(a) without delay, a description of the breach, including its nature, extent, timing and location of occurrence and the likely impact;

(b) within seventy-two hours of becoming aware of the breach, or within such longer period as the Board may allow on a request made in writing in this behalf,—

— Digital Personal Data Protection Rules, 2025, Rule 7(2)

Rule 7(2)(b) then lists six items for that detailed report, also set out below.

What do the two clocks mean in practice?

What counts (S.2(u)). The definition is wider than “we were hacked”. It covers any unauthorised processing, and also accidents: an email sent to the wrong list, a laptop left in a taxi, a deleted database with no backup. Loss of availability counts as well as loss of confidentiality, so ransomware that only locks your files is still a personal data breach.

There is no threshold. Rule 7 applies to “any personal data breach”. Neither the Act nor the Rules let you skip intimation because the risk to people looks low. A small incident gets a short intimation, not none.

The clock starts at awareness. Both intimations run from “becoming aware” of the breach. The Rules don’t define the moment, so write down your own trigger (for example, the time an incident is confirmed to involve personal data) and record when it happened. You will need that timestamp to show you met both clocks.

Clock one: without delay (Rule 7(1) and Rule 7(2)(a)). Each affected person, and the Board, get a first intimation as soon as you can give one. You report “to the best of its knowledge”, so you don’t wait for the investigation to finish.

Clock two: the detailed Board report within 72 hours (Rule 7(2)(b)). The Board then gets the fuller picture. If 72 hours is not enough, you may ask the Board in writing for longer; the extension is the Board’s to allow, not yours to assume.

The two clocks side by side:

	Clock one: first intimation	Clock two: detailed report
Who receives it	Each affected Data Principal, and the Board	The Board only
Deadline	Without delay (Rule 7(1), Rule 7(2)(a))	Within 72 hours of becoming aware, or a longer period the Board allows on a written request (Rule 7(2)(b))
Content	Five items for each person (Rule 7(1)(a)–(e)); for the Board, the breach’s nature, extent, timing, location and likely impact (Rule 7(2)(a))	Six items, from updated details to a report on the intimations sent (Rule 7(2)(b)(i)–(vi))
Channel	The person’s user account or a contact method they registered with you (Rule 7(1))	Rule 7 does not specify one

Rule 7’s two clocks. Source: DPDP Rules, 2025, Rule 7 (G.S.R. 846(E), as corrected by G.S.R. 892(E)).

Rule 7 by the numbers. One breach means three messages carrying 16 required content elements: 5 in each affected person’s intimation, 5 in the first description to the Board, and 6 in the detailed report. Method: counted from the clauses of Rule 7(1)(a)–(e), the elements listed in Rule 7(2)(a) and the clauses of Rule 7(2)(b)(i)–(vi), G.S.R. 846(E) as corrected by G.S.R. 892(E).

What each affected person must be told (Rule 7(1)(a)–(e)):

1. A description of the breach: its nature, extent, and when it happened.
2. The consequences likely to arise for them.
3. What you have done, and are doing, to reduce the risk.
4. What they can do to protect themselves.
5. Business contact details of a person who can answer their questions.

The message goes through their user account or a contact method they registered with you. Rule 2(1)(c) defines “user account” widely: it includes profiles, handles, email addresses and mobile numbers through which the person uses your service.

What the detailed Board report must contain (Rule 7(2)(b)(i)–(vi)): updated and detailed information on the first description; the broad facts about the events, circumstances and reasons that led to the breach; measures taken or proposed to reduce risk; any findings about who caused it; remedial measures to prevent it happening again; and a report on the intimations you sent to affected people.

Breaches at your vendors are still yours. The safeguards duty covers processing done “on its behalf by a Data Processor” (S.8(5)), and the Data Fiduciary stays responsible for its processors’ processing (S.8(1)). If your payroll provider or email platform suffers a breach involving your data, the intimations are your duty. The law does not set a deadline for the vendor to tell you, so put one in the contract.

What does a breach notification process look like for a 5–200 person company?

You can’t write intimations from scratch during an incident. Before 13 May 2027, have these ready:

1. A one-page breach runbook that names who decides an incident is a personal data breach, who writes and sends each intimation, and who signs off. In a 10-person company that may be the founder and one engineer; in a 150-person company, a named lead with a deputy.
2. A written “aware” trigger and a place to record the timestamp, so both clocks can be measured.
3. A template for affected people with a slot for each of the five Rule 7(1) items, in plain language. Include the contact person you already publish under Rule 9.
4. Two templates for the Board: a short first intimation (nature, extent, timing, location, likely impact, per Rule 7(2)(a)) and the detailed report with a heading for each Rule 7(2)(b) item.
5. A working route to every affected person. Know which system holds each user’s registered email or phone number, and test that you can message a chosen set of users, not just everyone.
6. Vendor clauses requiring each processor to tell you promptly about any incident affecting your data and to support the investigation. This sits alongside the security clauses Rule 6(1)(f) asks for.
7. Logs that let you answer the report’s questions. Rule 6(1)(c) and (e) require access logs, monitoring and review, kept for one year; those are what tell you the extent, timing and cause.
8. A record of every intimation sent: what, to whom, through which channel, and when. The detailed Board report must include a report on the intimations to affected people (Rule 7(2)(b)(vi)).
9. One rehearsal a year: run a tabletop exercise against the runbook and time both clocks.

For a ready-made version, with the roles, an hour-by-hour plan and all five templates, use our personal data breach runbook.

If your team builds these templates into its own tooling, the open-source DPDPA Engineering Kit has a tested Rule 7 notification formatter that builds all three messages, and counts the detailed report’s 72-hour deadline from when you became aware.

If you’d rather not build this alone, our DPDPA breach readiness service writes the runbook and the templates for both clocks with you.

Common mistakes

• Treating 72 hours as the only deadline. The first intimation to people and to the Board is “without delay” (Rule 7(1), Rule 7(2)(a)). The 72-hour period applies only to the detailed Board report (Rule 7(2)(b)).
• Borrowing GDPR’s wording. Rule 7 says “without delay”. GDPR Article 33 adds a qualifier that the Indian text does not have; don’t paste it into your runbook or templates.
• Telling only the Board. Section 8(6) requires intimation to each affected Data Principal as well.
• Applying a “low risk” filter. Rule 7 covers any personal data breach; there is no risk threshold to fall below.
• Citing the wrong Rule. Breach intimation is Rule 7. Several older articles pointed to Rule 13, which in the notified Rules covers Significant Data Fiduciary duties.
• Assuming the vendor will handle it. If the breach happened at your processor, the intimation duty is still yours (S.8(1), S.8(5)).
• Using “data breach” loosely. The statutory term is “personal data breach” (S.2(u)), and it includes accidental loss and loss of availability, not only theft.

Related obligations

• Security safeguards (coming soon): Rule 6’s minimum safeguards, including the logs and backups that make Rule 7 possible.
• Processor contracts (coming soon): where the vendor notice clause belongs.
• Rights and grievances (coming soon): the published contact person who appears in every breach message.
• Breach runbook: who does what, hour by hour, with five templates and CERT-In’s 6-hour report alongside.
• The full checklist: all eleven obligations on one page.

Further reading on the blog:

• DPDPA breach notification: automating SIEM alerts to legal workflows: the detection, classification and dispatch pipeline.
• Why India’s DPDP Act 2023 matters for breach management and customer trust: the business case, and how safeguards, processors and rights fit together.

Frequently asked questions

Does a small company have to report a personal data breach?

Yes. The duty in Section 8(6) applies to every Data Fiduciary, and the Act sets no size threshold. It applies from 13 May 2027 (Rule 1(4)).

Is there a 72-hour deadline?

For the detailed Board report, yes: within 72 hours of becoming aware, or longer if the Board allows on a written request (Rule 7(2)(b)). Before that, each affected person and the Board get a first intimation without delay (Rule 7(1), Rule 7(2)(a)).

Do we have to report a breach that we think caused no harm?

Yes. Rule 7 applies to any personal data breach. You describe the likely consequences in the intimation; you don’t decide whether to send it based on them.

Does a lost laptop or an email to the wrong person count?

Yes, if personal data was on it or in it. Section 2(u) covers accidental disclosure and loss of access as well as unauthorised processing.

Our cloud provider had the breach. Who reports it?

You do, as the Data Fiduciary. The Act keeps you responsible for processing done on your behalf (S.8(1), S.8(5)). Your contract should require the provider to tell you quickly so you can meet both clocks.

What happens after we notify the Board?

On receiving an intimation, the Board may direct urgent remedial or mitigation measures and may inquire into the breach (S.27(1)(a)). The maximum penalty for failing to give intimation is ₹200 crore (the Schedule, item 2), and the amount is set case by case; one factor is whether you acted to mitigate the effects, and how quickly (S.33(2)(e)).

When do the two clocks start?

On becoming aware of the personal data breach (Rule 7(1), Rule 7(2)). The Rules don’t define that moment, so write down your own trigger, such as the time an incident is confirmed to involve personal data, and record when it happened.

Can we wait until the investigation is finished before telling anyone?

No. Rule 7(1) asks you to tell each affected person “to the best of its knowledge” and without delay, and Rule 7(2)(a) sets the same pace for the first description to the Board. Send what you know now. The fuller picture goes in the detailed report (Rule 7(2)(b)(i)).

Does the 72-hour period for the detailed Board report stop at weekends or holidays?

Rule 7(2)(b) makes no exception for them. It counts seventy-two hours from becoming aware of the breach, and the only way to get longer is a written request that the Board allows. The rule doesn’t say when to ask; asking before the 72 hours run out is the safe course.

How do we reach each affected person?

Through their user account or any mode of communication they registered with you (Rule 7(1)). Rule 2(1)(c) counts profiles, pages, handles, email addresses and mobile numbers as part of a user account. Know in advance which system holds each person’s registered contact details.

Is ransomware that only locks our files a personal data breach?

Yes, if the locked files hold personal data. Section 2(u) covers loss of access to personal data that compromises its availability, so nothing has to be copied or leaked for the intimations to be due.

Does a breach of employee data count?

Yes. Your employees are Data Principals for their own records (S.2(j)), and Section 8(6) covers a personal data breach whatever the ground for processing. Employment is a legitimate use under S.7(i): it removes the need for consent, not the duty to intimate a breach.

We are a Data Processor. Do we tell the Board?

Section 8(6) and Rule 7 put the intimation duty on the Data Fiduciary, your client. That doesn’t mean a processor can sit on a breach: your client stays responsible for the processing you do on its behalf (S.8(1)), can use you only under a valid contract (S.8(2)), and that contract has to provide for security safeguards (Rule 6(1)(f)). Its clocks start when it becomes aware, so tell your client straight away and help it with the facts. For data you hold as a Data Fiduciary yourself, such as your own staff’s records, the duty is yours.

---

Checked against the DPDP Act, 2023 and the DPDP Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)) on 25 October 2026.

Not sure which of the eleven obligations are still open for you? The free DPDP Gap Identifier walks through them. If you’d rather talk it through with an engineer, get in touch.