Key points
- Every personal data breach must be reported under DPDP; there is no minimum size.
- Inform each affected Data Principal and the Data Protection Board without delay.
- Send the Board a detailed report within 72 hours of becoming aware of the breach (Rule 7).
- Cyber incidents may also need reporting to CERT-In within 6 hours.
- Failing to report a breach can cost up to ₹200 crore.
What counts as a personal data breach?
Any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability. A lost laptop, an email to the wrong person, ransomware, or a misconfigured cloud storage bucket can all qualify.
There is no minimum size. Every personal data breach must be reported.
Who must be informed, and when
| Who | When | What to include |
|---|---|---|
| Each affected Data Principal | Without delay | What happened (nature, extent, timing, location), likely consequences, what you have done to reduce harm, what they can do to protect themselves, and a contact person. |
| Data Protection Board | Without delay | A description of the breach: its nature, extent, timing, location and likely impact. |
| Data Protection Board | Within 72 hours of becoming aware, or longer if the Board allows | Updated details, the facts and reasons, mitigation measures, findings about who caused it, steps to prevent it recurring, and a report on the intimations sent to affected people. |
Messages to affected people must be concise, clear and in plain language, sent through their user account or registered contact details.
Other reporting you may also need
A cyber security incident may also need to be reported to CERT-In within 6 hours under its April 2022 directions. Regulated sectors such as banking, insurance and capital markets have their own regulator timelines. Your breach plan should cover all of them.
A practical 72-hour response plan
| Time | Action |
|---|---|
| 0–1 hour | Log the incident and call together the breach response team. |
| 1–6 hours | Contain it: isolate systems, revoke access, reset credentials, preserve evidence. Report to CERT-In if it is a cyber incident. |
| Without delay | Send the first intimation to the Data Protection Board and notify affected people. |
| Within 72 hours | Submit the detailed report to the Board. |
| Within 30 days | Fix the root cause, review what happened and update the plan. |
What happens if you do not report?
Failing to inform the Board or affected people of a breach can attract a penalty of up to ₹200 crore. Failing to take reasonable security safeguards to prevent the breach in the first place can attract up to ₹250 crore. See our DPDP penalties guide.
Get ready before a breach happens
- Name a breach response team with deputies and 24×7 contact details.
- Prepare templates for the Board intimation, the 72-hour report and the notice to affected people.
- Require vendors to tell you of breaches within hours, not days.
- Run a tabletop drill at least once a year.
Our DPDP template kit includes a full breach response plan with all six templates.
Frequently asked questions
How long do you have to report a data breach under DPDP?
You must inform the Data Protection Board and affected Data Principals without delay, and submit a detailed report to the Board within 72 hours of becoming aware of the breach, or a longer period if the Board allows on request.
Do small data breaches need to be reported under DPDP?
Yes. The DPDP Act has no size threshold. Every personal data breach must be intimated to the Board and to each affected Data Principal.
What must a breach notice to customers contain under DPDP?
Under Rule 7, a description of the breach including its nature, extent, timing and location; its likely consequences; the mitigation measures taken; safety measures the person can take; and contact details of someone who can answer their questions.
Do we also need to report to CERT-In?
Cyber security incidents may need to be reported to CERT-In within 6 hours under its 2022 directions, in addition to DPDP reporting. Sector regulators may also have their own requirements.
Official sources
- Digital Personal Data Protection Rules, 2025 (Ministry of Electronics and Information Technology)
- Government notifies DPDP Rules (Press Information Bureau, 14 November 2025)
- Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023)
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 in plain language for operational planning. It is not legal advice; check details against the official text and with your legal counsel.