---
title: "DPDP Breach Notification: 72-Hour Rule Explained | dpdpr.in"
description: "Personal data breach notification under the DPDP Act and Rule 7: what to tell the Board and users, and the 72-hour detailed report."
url: "https://dpdpr.in/guides/breach-notification/"
canonical: "https://dpdpr.in/guides/breach-notification/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# Personal data breach notification

A personal data breach is any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability ([section 2](https://dpdpr.in/act/section-2/)). The Data Fiduciary must inform the Board and each affected Data Principal ([section 8](https://dpdpr.in/act/section-8/)).

## To each affected person, without delay

1. A description of the breach: nature, extent, timing.
2. The likely consequences for her.
3. Mitigation measures taken or being taken.
4. Safety measures she may take.
5. Business contact of a person who can answer her questions.

Through her user account or a registered mode of communication, in a concise, clear and plain manner ([rule 7](https://dpdpr.in/rules/rule-7/)).

## To the Board

- **Without delay:** a description of the breach, including its nature, extent, timing, location and likely impact.
- **Within seventy-two hours** of becoming aware, or a longer period the Board allows on written request: updated details, the facts and reasons, mitigation, findings about who caused it, remedial measures and a report on the intimations given to people ([rule 7](https://dpdpr.in/rules/rule-7/)).

## Other reporting duties

The DPDP duty is separate from other laws. For example, CERT-In directions under the IT Act require reporting of certain cyber incidents. Check sector rules too ([section 38](https://dpdpr.in/act/section-38/)).

Failure to notify can attract a penalty of up to two hundred crore rupees (Schedule item 2). Section 8(6) and rule 7 come into force on 13 May 2027.