A data breach just hit your organisation: the hour by hour response under DPDP

It is 9:58 pm and your monitoring just confirmed it: someone accessed a database holding customer personal data. From this exact moment, India's DPDP framework treats your organisation as aware of a personal data breach, and two legal clocks are already running. This article walks the response hour by hour, with the official source behind every required step.

Everything starts at awareness, not at certainty

Rule 7 of the DPDP Rules 2025 frames both breach duties around one trigger: on becoming aware. There is no materiality threshold in the rule's text and no waiting period to confirm the details. The single most valuable thing you can do in the first minutes is record the exact date and time of awareness in your incident log, because every deadline that follows is measured from it.

The two clocks of Rule 7: from awareness at T+0, Track A intimates every affected person and Track B sends the Board a description, both without delay; the detailed Board submission with six required contents is due at T+72 hours, extendable only on a written request.

The first hour: contain and anchor

Before any notification, stop the bleeding. Isolate the affected systems, revoke exposed credentials, close the entry point, and preserve evidence while you do it. Assemble the response team in one room or one channel: an incident lead, security, engineering, legal, communications and support. Open a timestamped incident log that records events, circumstances and reasons as they become known; the seventy two hour Board submission will ask for exactly those facts, so a disciplined log writes most of it for you.

One legal point matters immediately: if a Data Processor holds or touches the affected data, instruct it to contain on its side and report what it knows to you. Section 8 of the Act keeps the Data Fiduciary responsible for complying with the framework, including in respect of processing undertaken on its behalf by a Data Processor. The breach happening inside a vendor does not move the duty.

Duty one: tell each affected person, without delay

Rule 7(1) requires an intimation to each affected Data Principal, to the best of your knowledge, in a concise, clear and plain manner, through the person's user account or a registered mode of communication. The rule fixes five contents:

• a description of the breach, including its nature, extent and the timing of its occurrence;
• the consequences relevant to that person that are likely to arise;
• the measures implemented and being implemented to mitigate risk;
• the safety measures the person may take to protect their interests;
• business contact information of a person able to respond to their queries.

Write it like a human being. The people receiving this message did nothing wrong, and the rule's plain manner requirement is on your side: no legal boilerplate, no burying the point. Log every send, with recipient, time and channel, because the Board submission must include a report on these intimations.

Duty two: tell the Board, twice

The Board intimation is staged, and the official text carries both clocks:

"On becoming aware of any personal data breach, the Data Fiduciary shall intimate to the Board, — (a) without delay, a description of the breach, including its nature, extent, timing and location of occurrence and the likely impact; (b) within seventy-two hours of becoming aware of the breach, or within such longer period as the Board may allow on a request made in writing in this behalf …"

Rule 7(2), truncated before items (i) to (vi), which are restated below.

Stage one is a description, sent without delay on the facts you have. Do not hold it back for the full picture; stage two exists to update and complete it. Stage two, due within seventy two hours of awareness, carries six required contents: updated and detailed information on the description already sent; the broad facts related to the events, circumstances and reasons leading to the breach; measures implemented or proposed to mitigate risk; any findings regarding the person who caused the breach; remedial measures taken to prevent recurrence; and a report regarding the intimations given to affected Data Principals. If seventy two hours is genuinely not enough, the only lawful route to more time is a request to the Board made in writing; send it before the deadline passes.

A practical note on where to send it: as of our last verification, the Board has not published a dedicated intimation channel in any primary source we track. What is official so far is that notification G.S.R. 844(E) establishes the Data Protection Board of India with its head office in the National Capital Region, and the Act has the Board function, as far as practicable, as a digital office. Watch the MeitY website for the channel; this site will add it, with its source, the day it is published.

After the deadline: what the Board can do

The intimation is not a formality that disappears into a mailbox. Under section 27(1)(a), the Board's powers switch on the moment it receives one:

"on receipt of an intimation of personal data breach under sub-section (6) of section 8, to direct any urgent remedial or mitigation measures in the event of a personal data breach, and to inquire into such personal data breach and impose penalty as provided in this Act;"

Section 27(1)(a) of the DPDP Act 2023.

That is why phase four of a good response is unglamorous but essential: verify that the remedial measures actually closed the gap, run a post incident review, and preserve the incident log, both intimations and the send records in one place. The Schedule's numbers explain the stakes: failing reasonable security safeguards carries a cap of two hundred and fifty crore rupees, and failing the breach notice duty carries two hundred crore rupees. If proceedings do begin, the Act also has a settlement track: under section 32, the Board may accept a voluntary undertaking at any stage of a section 28 proceeding, and acceptance bars further proceedings on the undertaking's contents.

The four phases at a glance

The playbook phases: contain and anchor the clock in the first hour; run the two intimation duties in parallel without delay; file the detailed Board submission within seventy two hours; then stabilise, review and preserve the record.

Prepare on a calm day

Every step above is easier if four things exist before any incident: named owners for each track with deputies, the two intimation drafts kept ready with your standing details, a current list of Data Processors with breach contacts, and one tabletop rehearsal from awareness to the seventy two hour submission. The downloadable starting templates cover both intimations.

When this becomes law, and what to do now

Rule 7 sits in the eighteen month commencement group; computed from the publication date of 13 November 2025, the group is due on 13 May 2027, and that calendar date is interpretation until officially confirmed. The clocks in Rule 7 are short and start on awareness, which makes building the workflow before the duty begins the entire point.

The interactive version of everything in this article is the data breach response playbook: enter your awareness time and it runs the live seventy two hour countdown, lays out the phases with parallel tracks, tracks your progress in your browser, previews and downloads sample intimations, and exports the whole plan to Excel.