DPDP data breach reporting: what Rule 7 actually requires

Rule 7 of the DPDP Rules 2025 turns a breach into two parallel duties with different depths and clocks. Both start at the same moment: when the Data Fiduciary becomes aware of the breach.

Duty one: tell the affected people, without delay

Each affected Data Principal must be intimated, to the best of the Data Fiduciary's knowledge, in a concise, clear and plain manner, through their user account or a registered mode of communication. The rule lists what the intimation must cover: a description of the breach with its nature, extent and timing, the consequences likely to arise for that person, the mitigation implemented and under way, the safety measures the person can take, and business contact information of someone able to answer questions.

Notice what is absent: there is no materiality threshold in the rule's text. The duty is framed around any personal data breach and every affected Data Principal.

Duty two: tell the Board, in two stages

The Board intimation is staged.

"On becoming aware of any personal data breach, the Data Fiduciary shall intimate to the Board, — (a) without delay, a description of the breach, including its nature, extent, timing and location of occurrence and the likely impact; (b) within seventy-two hours of becoming aware of the breach, or within such longer period as the Board may allow on a request made in writing in this behalf …"

Rule 7(2), truncated before items (i) to (vi), which are restated below.

The seventy two hour submission is the detailed one: updated information, the broad facts about the events, circumstances and reasons leading to the breach, mitigation, any findings about who caused the breach, remedial measures against recurrence, and a report on the intimations given to affected individuals. A longer period is possible, but only if the Board allows it on a written request.

When this starts to apply

Rule 7 sits in the eighteen month commencement group. Computed from the publication date of 13 November 2025, that group is due on 13 May 2027; the computed date is interpretation until officially confirmed. Building the workflow before the duty begins is the practical move, because the clocks in Rule 7 are short and start on awareness, not on convenience.

What to do

Decide now who detects, who drafts, who signs off and who talks to the Board. Capture the awareness moment in your incident process, prepare plain language templates for the Data Principal intimation, and rehearse the seventy two hour Board submission once. The breach response tool on this site walks the workflow step by step against the rule's own text.