Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 23 September 2026. Methodology

Concept

Personal data breach

Unauthorised or accidental events that compromise the confidentiality, integrity or availability of personal data. The definition is in force. The duty to tell affected people and the Board, under section 8(6) and Rule 7, commences on 13 May 2027, a date computed from the notification, so treat it as interpretation until officially confirmed.

Official requirement · verbatim

“personal data breach” means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data

Read section 2 of the Act, where this term is defined →Rule 7 of the DPDP Rules 2025 →

Related tool

Data Breach Response Playbook

Rule 7 is not in force yet, so plan its breach steps now, including the 72 hour submission to the Board, against the exact requirements.

Open

DPDP data breach reporting: what Rule 7 actually requires →

Sources cited on this page

  1. [1]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(u), p. 3. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026In force since 13 November 2025