A personal data breach is any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability (section 2). The Data Fiduciary must inform the Board and each affected Data Principal (section 8).
To each affected person, without delay
- A description of the breach: nature, extent, timing.
- The likely consequences for her.
- Mitigation measures taken or being taken.
- Safety measures she may take.
- Business contact of a person who can answer her questions.
Through her user account or a registered mode of communication, in a concise, clear and plain manner (rule 7).
To the Board
- Without delay: a description of the breach, including its nature, extent, timing, location and likely impact.
- Within seventy-two hours of becoming aware, or a longer period the Board allows on written request: updated details, the facts and reasons, mitigation, findings about who caused it, remedial measures and a report on the intimations given to people (rule 7).
Other reporting duties
The DPDP duty is separate from other laws. For example, CERT-In directions under the IT Act require reporting of certain cyber incidents. Check sector rules too (section 38).
Failure to notify can attract a penalty of up to two hundred crore rupees (Schedule item 2). Section 8(6) and rule 7 come into force on 13 May 2027.