Personal Data Breach Management Under the DPDP Act and Rules

· Sri Tulasi Tech Labs

Personal Data Breach Management Under the DPDP Act and Rules

Under the DPDP Act, a personal data breach is not only a security incident — it is a legal event with notification duties. Organisations that prepare in advance respond faster and limit the harm.

What counts as a personal data breach?

Any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to it, that compromises its confidentiality, integrity or availability. A misdirected email with customer details, a lost unencrypted laptop and a ransomware attack can all qualify.

Who must be told, and when

Affected Data Principals

Under the DPDP Rules, 2025, each affected person must be informed without delay, in clear and plain language, of:

  • a description of the breach, including its nature, extent, timing and location;
  • the likely consequences for them;
  • the measures taken or being taken to mitigate the risk;
  • safety measures they can take to protect themselves;
  • business contact details of a person who can answer their questions.

The Data Protection Board

The Board must be informed without delay, followed by a detailed report within 72 hours of becoming aware of the breach (or a longer period if the Board allows). The report covers the facts and circumstances, the cause, mitigation measures, any findings about the person responsible, remedial steps to prevent recurrence, and the reports sent to affected people.

The penalty for not notifying

Failing to notify the Board or affected Data Principals can attract a penalty of up to ₹200 crore — separate from any penalty for the security failure that caused the breach.

Build a breach response plan

  1. Detect — monitoring and logs so that breaches are noticed quickly.
  2. Contain — isolate affected systems, revoke credentials, recover data.
  3. Assess — what data, whose, how many people, what risk.
  4. Notify — affected people and the Board, using prepared templates.
  5. Remediate — fix the cause and record lessons learnt.
  6. Record — keep a breach register with decisions and evidence.

Practise before it happens

Name an incident lead, keep contact lists current, agree who approves notifications, and run a tabletop exercise at least once a year. Make sure your Data Processors are contractually bound to tell you about breaches promptly.

Check where your organisation stands

The DPDP Compliance Hub readiness assessment walks your team through these requirements with plain-language questions and gives you a readiness score and a gap report.

Note: This article gives general information about the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It is not legal advice. Obligations depend on your organisation, the applicable provisions and their commencement dates.