Personal data breach notification under the DPDP Rules

What counts as a personal data breach

The Act defines a breach broadly: any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability. A laptop with unencrypted patient files left in a cab counts. So does ransomware that locks your loan records, even if nothing leaves the building.

There is no size threshold in the Act. A breach affecting one customer is still a breach.

Telling the people affected

You must inform each affected Data Principal without delay, through their user account or the contact details you hold. The Rules set out what the message should cover, in clear and plain language, including what happened, the likely consequences for them, what you are doing about it, what they can do to protect themselves, and who they can contact.

Telling the Board

You must also inform the Data Protection Board without delay, with a description of the breach. Then, within 72 hours of becoming aware of it, you send a detailed report: the facts, what caused it, what you have done to reduce harm, any findings about who was responsible, and the steps to stop it happening again. The Board can allow a longer period if you ask for it.

The breach duties apply in Phase 3, around 13 May 2027 as notified. Check the MeitY site for how intimations are to be filed when the duty starts. Other regimes, such as CERT-In directions or your sector regulator's rules, may need their own reports on their own timelines.

Why 72 hours is shorter than it sounds

A typical sequence: the security team spots unusual exports from a CRM on a Friday night, confirms by Saturday that customer records were copied, and only on Monday learns that the CRM vendor's support account was the entry point. By then, half the window is gone and nobody has started on the list of affected people.

The teams that meet the deadline decided in advance who declares a breach, who drafts the notices, who signs off, and where the facts are recorded as they come in.

The cost of getting it wrong

Failing to notify a breach can attract a penalty of up to 200 crore rupees. A failure to take reasonable security safeguards to prevent the breach is a separate head, with a maximum of up to 250 crore rupees. The Board decides the actual amount.

How TrustOS helps

The breach response module gives you a running incident record, a clock from the time of awareness, task lists for each team, and drafts for the Data Principal and Board notices. It pulls the affected data categories and processors from your inventory, so you are not rebuilding that list under pressure.

It will not decide whether an event is a reportable breach. That call, and the wording of what you file, belongs with your security lead and legal counsel. TrustOS does not replace legal advice.