Under Sec. 8(6) of the DPDP Act, a Data Fiduciary must report a personal data breach to the Data Protection Board and to each affected Data Principal. Rule 7 of the DPDP Rules, 2025 sets the timing: both a first intimation to the Board and the notice to affected people go "without delay", and a detailed report follows to the Board within seventy-two hours of becoming aware of the breach.
The 72 hours belongs to one report only. A process built around one 72-hour clock misses the two "without delay" intimations. Rule 7 commences on 13 May 2027 under Rule 1(4).
What counts as a breach
Sec. 2(u) defines a personal data breach as "any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data."
That is wider than a hack. A misdirected email with a customer list, a lost laptop, ransomware that locks the data without exfiltrating it, and an employee reading records without authority all fit within the words. Neither Sec. 8(6) nor Rule 7 sets a size or risk threshold below which you can stay silent.
Prevention sits next door: Sec. 8(5) and Rule 6 require reasonable security safeguards, covered in DPDP security safeguards.
Step 1: Intimating affected Data Principals
Rule 7(1) applies "on becoming aware of any personal data breach". The Fiduciary must, to the best of its knowledge, intimate each affected Data Principal "in a concise, clear and plain manner and without delay", through her user account or any mode of communication she registered with the Fiduciary. The notice has five parts:
- a description of the breach, including its nature, extent and the timing of its occurrence;
- the consequences relevant to her that are likely to arise from it;
- the measures implemented and being implemented, if any, to mitigate risk;
- the safety measures she may take to protect her interests; and
- business contact information of a person who can respond to her queries.
The channel is fixed by the rule: her account or a contact method she registered. A banner on your website is not enough on its own. This is also why a contact-data inventory matters: you can only reach people through channels you hold.
Step 2: First intimation to the Board
Rule 7(2)(a) requires, without delay, a description of the breach, including its nature, extent, timing and location of occurrence, and the likely impact.
The words "to the best of its knowledge" appear in Rule 7(1), and the first Board intimation is framed as a description, with the fuller account coming later. You are not required to wait for a complete root-cause analysis before sending the first one. The Rules do not define "without delay" in hours.
Step 3: The 72-hour detailed report
Rule 7(2)(b) requires, within seventy-two hours of becoming aware, or within a longer period the Board allows on a request made in writing, six things:
- updated and detailed information in respect of the description given earlier;
- the broad facts related to the events, circumstances and reasons leading to the breach;
- measures implemented or proposed, if any, to mitigate risk;
- any findings regarding the person who caused the breach;
- remedial measures taken to prevent recurrence; and
- a report regarding the intimations given to affected Data Principals.
The last item links Step 1 to Step 3. The Board expects evidence of what you told people, so keep a copy of each notice and the date it went out. An extension is not automatic: it needs a written request, and the Board decides.
Who is "aware"
Rule 7 runs from the Data Fiduciary becoming aware. The Act separately makes the Fiduciary responsible for processing by its Processors (Sec. 8(1)) and requires reasonable safeguards over data processed on its behalf (Sec. 8(5)). The rules do not spell out when a Processor's knowledge counts as the Fiduciary's. Treat that as a contract matter: require the Processor to notify you promptly, in a stated number of hours, with the facts you need for the Rule 7 report, and do not assume the clock waits for the vendor to tell you.
What the penalty looks like
The Schedule to Sec. 33(1) sets a ceiling of 200 crore rupees for failing to give the Board or an affected Data Principal notice of a breach under Sec. 8(6). A separate ceiling of 250 crore rupees applies to the safeguards failure that may have caused the breach in the first place. They are ceilings, not tariffs. Under Sec. 33(1) the Board may impose a penalty only after an inquiry in which it determines the breach is significant, and Sec. 33(2) lists matters it must weigh, including the gravity and duration of the breach and the mitigation taken and how promptly. See DPDP penalties explained for the full Schedule and process.
That makes the record valuable. A breach that was detected quickly, reported on time and followed by documented remediation reads differently from one found by a third party months later.
A response plan that fits Rule 7
Rule 7 leaves the plumbing to you. A plan that holds up has these pieces:
- a named owner who can declare a breach and a way to record the moment of awareness;
- templates for the Data Principal notice and the two Board filings, with the Rule 7 items as fields;
- a contact list for affected people drawn from the registers you already keep;
- Processor contract terms on prompt notification; and
- a rehearsal, so the first run is not the real one.
The processing register shows where personal data lives, which tells you whom to notify. For the full duty set, see what is the DPDP Act. The compliance checklist sets breach reporting among the twelve items in build order, and the compliance map ties Sec. 8(6) and Rule 7 to a control. Fintechs with partner and vendor chains can see how this plays out in the fintech guide.