Chapter 10: Data Breach Notification

Breach reporting requirements and timelines

chapter · 2 min read · Updated 14-Feb-2026 · 10 of 14

Executive Summary

•If you leak data, you can't sweep it under the rug. You must tell the Data Protection Board and (crucially) the affected users. Fast.

•Without delay: On becoming aware of a breach, notify each affected Data Principal and give the Board an initial description without delay.
•Board follow-up: Give the Board the detailed information required by rule 7(2)(b) within 72 hours, unless the Board allows a longer period on a written request.
•Useful notice: Tell affected people what happened, the likely consequences, mitigation, protective steps they can take, and whom they can contact.

•Right to Know: You deserve to know if your passwords or financial info were stolen so you can protect yourself.

Practical application

Use these examples to distinguish a defensible process from a common mistake.

Right

✓After discovering a breach, an organization records what happened, notifies the Board and affected users, and explains remediation.

Incorrect

×A business delays notification while investigating internally or tells users only that a vague ‘technical issue’ occurred.

Details obligations for notifying authorities and Data Principals about data breaches.

Breach scope: Section 8(6) applies when a personal data breach occurs
Notification timeline: Affected Data Principals and the Board receive initial information without delay; the detailed Board follow-up is due within 72 hours unless extended
Notification content: Information to include in breach notifications
Notification recipients: Who must be notified (Board, Data Principals)

Primary sources: section 8(6) of the DPDP Act and rule 7 of the DPDP Rules.