Data Breach Notification India
The 72-Hour Rule Under DPDP
When a personal data breach occurs in India, the clock starts immediately. The CERT-In Directions 2022 require incident reporting within 6 hours. The DPDP Act 2023 mandates notification to the Data Protection Board and affected individuals within the prescribed timeline — expected to be 72 hours, consistent with global standards. Failure to notify carries a penalty of up to Rs.200 crore, separate from any penalty for the underlying security failure.
This guide covers both notification regimes, what triggers them, who must be notified, what information must be provided, and the step-by-step emergency response protocol every company should have ready before a breach occurs. By Advocate Subodh Bajpai, Senior Partner at Unified Chambers and Associates.
India’s Dual Breach Notification Regime
India operates two concurrent breach notification frameworks, each with distinct scopes, timelines, and enforcement bodies. Companies must comply with both simultaneously when a personal data breach occurs.
The critical distinction: CERT-In notification covers all cyber security incidents (including those that do not involve personal data), while DPDP notification specifically targets personal data breaches and requires notification to affected individuals as well as the regulator. A ransomware attack on a company’s financial systems that does not compromise personal data triggers CERT-In reporting but not DPDP notification. A breach exposing customer personal data triggers both.
For companies in regulated sectors, additional obligations apply. Banks must notify the Reserve Bank of India (RBI) under its cybersecurity framework. Insurance companies must notify IRDAI. Telecom operators must notify DoT. Securities market intermediaries must notify SEBI. A single data breach can therefore trigger five or more separate regulatory notifications, each with different formats, timelines, and contact points.
What Constitutes a “Personal Data Breach” Under DPDP
Section 2(u) of the DPDP Act defines “personal data breach” as any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction of, or loss of access to personal data that compromises the confidentiality, integrity, or availability of personal data. This definition is intentionally broad, covering every category of incident that affects personal data.
External Attacks
Hacking, phishing, credential stuffing, SQL injection, ransomware encrypting personal data, man-in-the-middle interception, API exploitation
Internal Incidents
Employee accessing records without authorisation, accidental email to wrong recipient, unintended publication of personal data on company website, insider data theft
System Failures
Database corruption causing data loss, backup failure resulting in permanent data destruction, misconfigured cloud storage exposing personal data publicly (S3 bucket incidents)
Vendor Incidents
Third-party processor suffering a breach affecting your personal data, cloud provider security incident, SaaS platform vulnerability exposing tenant data
A common misconception: many companies believe a “data breach” only means data theft or exfiltration. Under the DPDP definition, a ransomware attack that encrypts personal data without exfiltrating it is a personal data breach because it causes “loss of access to personal data.” Similarly, an accidental deletion of customer records without backup is a breach because it constitutes “destruction of personal data.” Companies must train their incident response teams to recognise the full scope of what constitutes a reportable breach.
Notification Timeline — Hour by Hour
Breach Detected or Reported
The clock starts when any person in the organisation becomes aware that a personal data breach may have occurred. This includes: automated alerts from security systems, reports from employees, notifications from third-party vendors, reports from affected individuals, or media reports. Document the exact time and source of first awareness. This timestamp is critical for demonstrating compliance with notification timelines.
Initial Assessment and Containment
Activate the breach response team. Conduct initial triage: confirm whether a breach has actually occurred (vs. a false positive); determine whether personal data is affected; assess the scope (number of records, categories of data, systems affected); and take immediate containment measures (isolate affected systems, revoke compromised credentials, block malicious IP addresses). Do not shut down systems that may contain forensic evidence.
CERT-In Notification (Mandatory)
Prepare and submit the CERT-In incident report within 6 hours of becoming aware of the incident. The report must include: nature of the incident, systems affected, geographical scope, and initial assessment of impact. CERT-In provides an online reporting portal and a dedicated email (incident@cert-in.org.in). This is a hard deadline — CERT-In has the power to impose penalties for non-compliance under the IT Act, 2000.
Forensic Investigation and Scope Assessment
Engage external forensic investigators if the breach is significant. Determine: the root cause of the breach; the full scope of personal data affected; whether data was actually exfiltrated or only accessed/encrypted; the number of affected Data Principals; and whether the breach is ongoing or contained. Preserve all logs, forensic images, and evidence. This investigation informs both the DPDP Board notification and the communication to affected individuals.
DPDP Board and Individual Notification
Prepare and submit the notification to the Data Protection Board in the prescribed format. Simultaneously prepare the notification to affected Data Principals. The individual notification must be clear, non-technical, and must include: what happened, what personal data was affected, what the company is doing about it, and what steps the individual should take to protect themselves. If the investigation is still ongoing, submit an initial notification with a commitment to provide supplementary information as it becomes available.
Supplementary Reporting and Remediation
Continue the investigation. Submit supplementary reports to the DPDP Board as new information emerges. Implement permanent remediation measures (not just temporary patches). Conduct a post-incident review. Update security safeguards based on lessons learned. Retain all breach-related records for the period prescribed in the DPDP Rules. If the company is in a regulated sector, submit parallel reports to the relevant sectoral regulator (RBI, IRDAI, SEBI, DoT).
Penalties for Breach Notification Failure
A single data breach incident can expose a company to multiple, stacking penalties under the DPDP Act. The penalties are not mutually exclusive — each obligation has its own penalty category in the Schedule.
Failure to implement reasonable security safeguards that caused or contributed to the breach
Failure to notify the Data Protection Board and affected individuals of the breach
Additional penalty if the breach involved children's personal data
Additional penalty for any other contravention — e.g., cross-border transfer violations, consent failures, or purpose limitation breaches
The theoretical maximum exposure for a single data breach involving children’s data with inadequate security, where the company also fails to notify and has other contraventions, could reach Rs.700 crore in cumulative penalties (Sl.1: Rs.250 Cr + Sl.2: Rs.200 Cr + Sl.3: Rs.200 Cr + Sl.7: Rs.50 Cr). While such an extreme scenario is unlikely, it illustrates why breach preparedness is a board-level priority, not an IT department afterthought.
7-Step Emergency Response Protocol
Establish a Breach Response Team Before a Breach Occurs
Designate members from legal, IT/security, communications, HR, and executive leadership. Define roles, escalation paths, and decision authority. The team should be able to convene within 30 minutes of a breach alert. Store contact details (personal mobiles, not just office numbers) in an accessible location outside the potentially compromised corporate network.
Pre-Draft Notification Templates
Work with legal counsel to pre-draft notification templates for the Data Protection Board, CERT-In, and affected individuals. These templates should have fill-in-the-blank sections for breach-specific details. In the chaos of an active breach, drafting notifications from scratch costs precious hours. Pre-approved templates ensure legally compliant notifications are sent within the required timelines.
Deploy Breach Detection Systems
You cannot notify what you do not detect. Implement: Security Information and Event Management (SIEM) for log aggregation and alerting; Data Loss Prevention (DLP) tools for exfiltration detection; endpoint detection and response (EDR) on all endpoints; network traffic analysis for anomaly detection. The faster you detect, the smaller the breach scope and the more time you have for notification.
Maintain a Data Inventory
During a breach, the first question is: what data was affected? Without a current data inventory mapping which personal data resides in which systems, answering this question takes days. Maintain an updated data map (Step 02 of the DPDP compliance checklist). Know exactly what personal data each system contains so you can immediately assess the scope of any breach.
Engage External Counsel and Forensics on Retainer
When a breach occurs, you do not have time to evaluate and onboard legal counsel and forensic investigators. Establish retainer agreements with a law firm experienced in data protection law and a digital forensics firm before any breach occurs. Retainer agreements with pre-agreed hourly rates and response SLAs (ideally 2-4 hours for initial mobilisation) ensure immediate expert support when the clock is ticking.
Conduct Quarterly Tabletop Exercises
Simulate breach scenarios quarterly. The exercise should involve the full breach response team and should test: detection and escalation workflows, CERT-In notification within 6 hours, DPDP Board notification within 72 hours, individual notification content and delivery, media and stakeholder communications, and post-incident review. Each exercise should identify gaps and result in concrete improvements to the response plan.
Document Everything from Minute One
From the moment a breach is suspected, document every action taken, every decision made, and every communication sent. This contemporaneous record serves two purposes: it demonstrates to the Data Protection Board that you responded diligently and within timelines, and it provides the evidentiary foundation for any penalty proceeding or litigation that follows. Use a dedicated incident log with timestamped entries.
Data Breach Notification — Questions Answered
What is the difference between the CERT-In 6-hour rule and the DPDP notification requirement?
What constitutes a "personal data breach" under the DPDP Act?
Who must be notified in case of a personal data breach?
What information must be included in a breach notification to the DPB?
What is the penalty for failing to notify a data breach?
Does the 72-hour clock start from when the breach occurs or when it is discovered?
Data Breach? Act Within Hours, Not Days.
Breach notification deadlines are measured in hours. Unified Chambers provides emergency legal support for data breach incidents — CERT-In reporting, DPDP Board notification, and crisis management. Advocate Subodh Bajpai available directly.