What the Data Protection Board expects in a breach report
"Without delay" plus a detailed report within 72 hours. A walkthrough of what to include, drawn from the DPDP Rules themselves.
In short
- After a personal data breach, the DPDP Rules require notices to affected people and to the Data Protection Board, without delay.
- A detailed report to the Board is due within 72 hours of becoming aware, unless the Board allows longer.
- Both notices depend on evidence, so keep an intact timeline of the incident from the start.
When a personal data breach happens, the DPDP Rules, 2025 expect two notifications: one to the people affected, and one to the Data Protection Board of India. Rule 7 sets out what each should contain. This walkthrough follows its structure. It becomes enforceable on 13 May 2027.
Step 1: tell affected people, without delay
Each affected person must be told, without delay, in a concise, clear and plain way, through their user account or the contact details you hold. The notice should cover:
- What happened: the nature, extent, timing and location of the breach
- The consequences likely to affect them
- What you have done, and are doing, to reduce the risk
- Safety steps they can take themselves, such as changing a password
- Contact details of a person who can answer their questions
Step 2: tell the Board, without delay
The Board must also be told without delay. The first intimation describes the breach, including its nature, extent, timing and location, and its likely impact. Like CERT-In's first report, it is meant to be early, not complete.
Step 3: the detailed report, within 72 hours
Within 72 hours of becoming aware of the breach, or a longer period if the Board allows it on a written request, you send the Board a detailed report. It covers:
- Updated and detailed facts about the breach
- The circumstances and reasons that led to it
- Measures taken, or proposed, to mitigate the risk
- Any findings about the person who caused the breach
- Remedial steps to stop it happening again
- A report on the notices you sent to affected people
What this means in practice
Every item on that list depends on evidence. A clear timeline of what the attacker did, when, and from where is the backbone of both reports. Collect it from the start, keep it intact, and record who did what during your response.
It also means running two tracks at once. The same incident may need a CERT-In report within 6 hours and DPDP notices without delay. A single, well-kept record of the incident saves you from writing the same facts twice under pressure, and from contradicting yourself.
Want to know what an attacker would find in your environment?
Get a free exposure check