DPDPA requires Data Fiduciaries to notify the Data Protection Board and affected Data Principals in the event of a data breach. The DPDP Rules, 2025 set the timeline, scope, and format — here is what businesses must prepare for.
Many Indian businesses have no formal incident response plan. A ransomware attack, leaked database, or accidental email disclosure that exposes customer or employee personal data triggers mandatory notification obligations under DPDPA. Failing to notify can result in penalties up to ₹200 crore. More importantly, delayed or mishandled breach communication dramatically erodes customer trust.
Businesses must develop or update incident response plans to include DPDPA notification requirements. Contracts with vendors and cloud providers must include breach notification SLAs. Security practices around access logs, encryption, and monitoring should be reviewed. Internal escalation protocols must be documented.
Section 8(6) of DPDPA requires every Data Fiduciary to notify the Data Protection Board (DPB) and each affected Data Principal of a personal data breach 'in such form and manner as may be prescribed'. The DPDP Rules, 2025 require a two-stage notification: an initial report within 72 hours of becoming aware of the breach, followed by a detailed investigation report. Each affected Data Principal must also be informed — the Act sets no risk threshold or de minimis exception for this. Businesses should now build basic incident response capabilities: detection, containment, assessment, notification, and remediation. Reviewed: March 2026.
Designate a Data Protection point of contact internally
Create a basic incident response runbook with DPDPA notification steps
Review your cloud and vendor contracts for breach notification clauses
Test whether you can detect a data breach within 24 hours
Document what constitutes a 'personal data breach' for your business
Identify all systems containing personal data and their access logs
Prepare breach notification templates for the DPB and for customers
Free — takes 3 minutes
Answer a few simple questions. Get your free Readiness Score — sent to your email or WhatsApp.
Check My Readiness →Take our free 3–5 minute industry assessment to find out your compliance risk level.
Take Free Assessment →Free Download
The Complete DPDPA Compliance Guide
Plain English. Everything your business needs to understand the DPDP Rules 2025 — written for founders, not lawyers. Now in 7 Indian languages.
Download the Guide →5 Ready-to-Use Templates
Start complying — not just reading
Privacy Notice, Consent Language, Data Inventory, DSR SOP, Vendor Register. Delivered free to your email.
2-min reads, plain English, every morning. Free forever.
