Data Breach Notification Under DPDP: The 72-Hour Drill

Under the DPDP Act, a personal data breach triggers an obligation to notify both the Data Protection Board and the affected individuals - and the practical discipline every organisation should build now is a drill that gets from detection to notification fast.

Key facts at a glance

• A personal data breach covers unauthorised access, disclosure, alteration, loss or destruction of personal data.
• Notification is owed to both the Data Protection Board of India and the affected data principals.
• Many organisations plan around a 72-hour internal response target as good breach-response practice.
• Penalties for inadequate security safeguards can reach up to Rs 250 crore per instance.
• Full DPDP obligations, including breach notification, become enforceable from 13 May 2027.
• The data fiduciary stays accountable even if a third-party processor caused the breach.
• The Data Protection Board provisions are already active ahead of the full 2027 enforcement date.

What Counts as a Breach

DPDP defines a personal data breach broadly. It is not limited to a hacker stealing a database - it includes:

• Accidental exposure of data (e.g. a misconfigured cloud storage bucket left public)
• Loss of a device containing unencrypted personal data
• Unauthorised access by an employee outside their role
• Ransomware or malware incidents affecting systems that hold personal data
• Sending personal data to the wrong recipient at scale

The common thread is any compromise of confidentiality, integrity or availability of personal data - not just theft.

Who Needs to Know, and In What Order

Building a 72-Hour Drill

Many organisations use a 72-hour internal target - a widely recognised benchmark from other data-protection regimes - as the pace to aim for, even while confirming exact prescribed timelines under the applicable DPDP Rules. A workable drill breaks into four phases:

Hour 0-4: Detect and Contain

• Identify the system or data affected.
• Isolate affected systems to stop further exposure.
• Assign an incident owner (not necessarily the most senior person - the one who can act fastest).

Hour 4-24: Assess Scope

• Determine what data categories were involved (e.g. names and emails vs. financial or health data).
• Estimate how many data principals are affected.
• Check whether a third-party processor was involved and pull them into the response.

Hour 24-48: Prepare Notifications

• Draft the notification to the Data Protection Board with a factual, non-speculative account of what is known so far.
• Draft a plain-language notice for affected individuals - what happened, what data, what they should do.
• Loop in legal/compliance advisors if available.

Hour 48-72: Notify and Remediate

• Send notifications.
• Begin remediation: patch the vulnerability, rotate credentials, review access logs.
• Document the entire timeline - what was detected when, and what actions were taken - since this record matters if the Board asks questions later.

Why the Drill Matters Even Before 2027

Full DPDP obligations are enforceable from 13 May 2027, but breaches do not wait for enforcement dates. A business that has never rehearsed this process will lose critical hours figuring out who does what, while a business with even a one-page runbook can move immediately. Waiting until an actual incident to design the process is the most common and costly mistake.

Practical Steps to Prepare Now

1. Write a one-page breach-response runbook naming who does what in the first 72 hours.
2. Identify your Data Protection Board contact point and process in advance, so you are not searching for it during an incident.
3. Pre-draft a notification template for affected individuals that can be filled in quickly.
4. Review vendor contracts to ensure processors are contractually required to notify you promptly of any incident on their end.
5. Run a tabletop exercise at least once a year with the team that would actually respond.

If you are not sure how ready your business is to handle a breach notification under DPDP, ComplianceCheck's DPDP assessment gives you a clear picture in a few minutes.

Sources

• Ministry of Electronics and Information Technology, DPDP Act and Rules - meity.gov.in
• Data Protection Board of India

This guide is general information, not legal advice. Requirements vary by state, sector and headcount - confirm specifics with a compliance professional or the relevant authority.