Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 28 October 2026. Methodology

Concept

Personal data breach

Unauthorised or accidental events that compromise the confidentiality, integrity or availability of personal data. The definition is in force. The duty to tell affected people and the Board, under section 8(6) and Rule 7, commences on 13 May 2027, a date computed from the notification, so treat it as interpretation until officially confirmed.

Official requirement · verbatim

“personal data breach” means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data

Read section 2 of the Act, where this term is defined →Rule 7 of the DPDP Rules 2025 →

What the definition covers

Plain English

The definition has 2 limbs. The first is any unauthorised processing of personal data. The second is accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data. The definition closes with the words that compromises the confidentiality, integrity or availability of personal data. The definition has been in force since 13 November 2025 and imposes no duty on its own.

Interpretation requires judgment

The closing words of the definition are best read as qualifying both limbs, so an event is a personal data breach when it compromises the confidentiality, integrity or availability of personal data. Beyond that, neither the definition nor the intimation duty in section 8(6) carries a size, harm or likelihood of harm threshold, so an incident that only makes data unavailable, with nothing disclosed, can still be a personal data breach through loss of access and availability. Section 8(6) applies in the event of a personal data breach, Rule 7 applies on becoming aware of any personal data breach, and Rule 7 asks for a description of the breach and its likely consequences or impact rather than setting a threshold for whether to report. Section 8(6) and Rule 7 commence on 13 May 2027, a date computed from the commencement notification, so treat it as interpretation until officially confirmed.

Plain English

2 duties of the Data Fiduciary are built on the term. Section 8(5) requires reasonable security safeguards to prevent a personal data breach, including for processing done on its behalf by a Data Processor. Section 8(6) requires intimation of a breach to the Board and to each affected Data Principal, and Rule 7 sets the manner. Each affected Data Principal is told, to the best of the Data Fiduciary's knowledge, in a concise, clear and plain manner and without delay, through her user account or a registered mode of communication: a description of the breach, the consequences likely to arise for her, any mitigation measures, the safety measures she may take, and business contact information of a person who can respond to her queries. The Board is told without delay with a description of the breach and its likely impact, and then, within 72 hours of the Data Fiduciary becoming aware of the breach or a longer period the Board allows on a written request, receives updated and detailed information, including the facts leading to the breach, mitigation and remedial measures, any findings on who caused it and a report on the intimations given to Data Principals. Section 8 and Rule 7 commence on 13 May 2027, a date computed from the commencement notification, so treat it as interpretation until officially confirmed.

Plain English

The 2 duties carry different penalties and survive the exemptions differently. Under the Schedule, a breach of the section 8(5) safeguards duty may attract a penalty extending to 250 crore rupees, and a failure to give notice under section 8(6) a penalty extending to 200 crore rupees. Section 17(1) switches off most of Chapter II in the cases it lists, but it expressly keeps sections 8(1) and 8(5), so in those cases the safeguards duty still applies while the section 8(6) intimation duty does not. That carve back is limited to section 17(1): section 17(2) disapplies the whole Act, including section 8(5), for processing by a State instrumentality the Central Government notifies in the interests of sovereignty and integrity of India, security of the State and the other grounds it lists, and for processing for research, archiving or statistical purposes that meets its conditions, and section 17(5) lets the Central Government, within 5 years of commencement, declare that any provision does not apply to notified Data Fiduciaries for a specified period. On an intimation the Board may direct urgent remedial or mitigation measures and inquire under section 27(1)(a), and a Data Principal may complain to it about a personal data breach under section 27(1)(b). Section 6(9) and section 27(1)(d) commence on 13 November 2026. Sections 4, 5, 6(1) to 6(8), 6(10), 7 to 10, 17, section 27 except section 27(1)(d), and section 33 commence on 13 May 2027. Both dates are computed from the commencement notification, so treat them as interpretation until officially confirmed.

Related tool

Data Breach Response Playbook

Rule 7 is not in force yet, so plan its breach steps now, including the detailed submission to the Board within 72 hours unless it allows longer on a written request, against the exact requirements.

Open

Articles that use this term

Sources cited on this page

  1. [1]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(u), p. 3. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026In force since 13 November 2025
  2. [2]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(u), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
    any unauthorised processing of personal data
  3. [3]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(u), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
    accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data
  4. [4]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(u), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
    that compromises the confidentiality, integrity or availability of personal data
  5. [5]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (a), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Document status: published; in effect per its own terms
    the date of publication of this notification in the Official Gazette as the date on which the provisions of sub-section (2) of section 1, section 2
  6. [6]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(u), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
    loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data
  7. [7]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(6), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    In the event of a personal data breach, the Data Fiduciary shall give the Board and each affected Data Principal, intimation of such breach
  8. [8]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (1), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    On becoming aware of any personal data breach, the Data Fiduciary shall, to the best of its knowledge, intimate to each affected Data Principal
  9. [9]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (1), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    the consequences relevant to her, that are likely to arise from the breach
  10. [10]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (2), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    a description of the breach, including its nature, extent, timing and location of occurrence and the likely impact
  11. [11]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 23 October 2026Document status: published; in effect per its own terms
    eighteen months from the date of publication of this gazette, on which the provision of sections 3 to 5, sub-sections (1) to (8) and (10) of section 6,sections 7 to 10, sections 11 to 17, section 27 except clause (d) of sub-section (1) of the said section, sections 28 to 34, 36, 37 and sub-section (2) of section 44 of the said Act shall come into force.
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 23 October 2026
  12. [12]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 1, (4), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
    Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026
  13. [13]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(5), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach
  14. [14]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(6), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    the Data Fiduciary shall give the Board and each affected Data Principal, intimation of such breach in such form and manner as may be prescribed
  15. [15]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (1), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    in a concise, clear and plain manner and without delay, through her user account or any mode of communication registered by her with the Data Fiduciary
  16. [16]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (1), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    the safety measures that she may take to protect her interests
  17. [17]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (1)(e), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    business contact information of a person who is able to respond on behalf of the Data Fiduciary, to queries, if any, of the Data Principal
  18. [18]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (2)(a), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    without delay, a description of the breach, including its nature, extent, timing and location of occurrence and the likely impact
  19. [19]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (2), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    within seventy-two hours of becoming aware of the breach, or within such longer period as the Board may allow on a request made in writing in this behalf
  20. [20]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (2)(b), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    updated and detailed information in respect of such description
  21. [21]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (2)(b), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    a report regarding the intimations given to affected Data Principals
  22. [22]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), The Schedule, p. 21. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach
  23. [23]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), The Schedule, p. 21. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    May extend to two hundred and fifty crore rupees.
  24. [24]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), The Schedule, p. 21. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    Breach in observing the obligation to give the Board or affected Data Principal notice of a personal data breach
  25. [25]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), The Schedule, p. 21. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    May extend to two hundred crore rupees.
  26. [26]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(1), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    The provisions of Chapter II, except sub-sections (1) and (5) of section 8, and those of Chapter III and section 16 shall not apply where
  27. [27]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    The provisions of this Act shall not apply in respect of the processing of personal data
  28. [28]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2)(a), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    by such instrumentality of the State as the Central Government may notify
  29. [29]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2)(a), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    in the interests of sovereignty and integrity of India, security of the State
  30. [30]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2)(b), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    research, archiving or statistical purposes if the personal data is not to be used to take any decision specific to a Data Principal
  31. [31]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(5), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
    declare that any provision of this Act shall not apply to such Data Fiduciary or classes of Data Fiduciaries for such period as may be specified in the notification
  32. [32]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 27(1)(a), p. 14. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Phased commencement; it commences in 2 parts: clause (d) of sub section (1) on the computed date 13 November 2026, which is interpretation until officially confirmed, then the rest on the computed date 13 May 2027, which is interpretation until officially confirmed
    to direct any urgent remedial or mitigation measures in the event of a personal data breach, and to inquire into such personal data breach
  33. [33]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 27(1)(b), p. 14. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Phased commencement; it commences in 2 parts: clause (d) of sub section (1) on the computed date 13 November 2026, which is interpretation until officially confirmed, then the rest on the computed date 13 May 2027, which is interpretation until officially confirmed
    on a complaint made by a Data Principal in respect of a personal data breach
  34. [34]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (b), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 23 October 2026Document status: published; in effect per its own terms
    one year from the date of publication of this gazette on which the provisions of sub-section (9) of section 6 and clause (d) of sub-section (1) of section 27 of the said Act shall come into force.