/ DPDP Breach Urgent Response · Updated 2026-10-25
DPDP Personal Data Breach 72-Hour Notification Urgent India, DPDP Act breach response + Data Protection Board notification.
Personal data breach discovered. DPDP Act 2023 Section 8(6) requires notification to Data Protection Board of India + each affected data principal 'without delay' - industry expects 72 hour window (similar to GDPR). Penalty up to INR 250 crore for failure. Specific breach response + legal + technical workflow. BQP urgent engagement with foreign counsel coordination. Here's the complete playbook.
DC
Written by CA Durgesh Chavda
Chartered Accountant (ICAI) · Founder, Bharat Quantum Prospera · US incorporation, India-US DTAA, FEMA ODI, NRI taxation, cross-border structuring · LinkedIn
/ DPDP breach notification framework
The 72-hour window.
- Section 8(6) DPDP Act 2023: Data Fiduciary must notify Data Protection Board (DPB) AND each affected data principal in the event of personal data breach.
- Timing: 'without delay' - industry interpretation + GDPR analogy = 72 hours typically.
- Specific Rules under finalisation (expected Budget 2026 notification) - exact format + timeline + specific content requirements.
- Penalty: up to INR 200 crore for failure to notify. Up to INR 250 crore for inadequate security safeguards leading to breach.
- Appeal: TDSAT within 60 days of DPB order.
/ 72-hour breach response workflow
Clock starts on discovery.
- Hour 0-6: Breach discovery + initial containment. Isolate affected systems + preserve forensic evidence + specific access controls.
- Hour 6-24: Incident response team assembled (CISO + Legal + Communications + Data Protection Officer if SDF + external cybersecurity + external legal counsel).
- Hour 12-24: Scope assessment - affected data principals + nature of data + specific risk assessment + specific attack vector.
- Hour 24-48: Legal notification preparation - DPB notification draft + data principal notification draft + specific regulatory parallel notifications (SEBI if listed, RBI if financial sector, specific sector regulator).
- Hour 48-72: Notifications sent - DPB + data principals + specific parallel regulators + specific media/public communications if material + specific contractual counterparts.
- Day 4-14: Specific remediation + specific data subject assistance + ongoing investigation + specific legal defence preparation.
- Week 2+: DPB investigation response + specific inquiry + specific adjudication defence.
/ Required breach notification content
What to include.
- Nature of personal data breach + affected data categories.
- Number of affected data principals (approximate).
- Nature of personal data (sensitive / standard / specific categories).
- Likely consequences of breach for data principals (identity theft risk, financial fraud risk, specific risks).
- Measures taken by Data Fiduciary to address breach.
- Measures recommended to data principals (password changes, specific monitoring, specific protective actions).
- Contact point for data principals (Data Protection Officer if SDF, grievance officer).
/ Specific parallel compliance
Where DPDP overlaps with other regulators.
- CERT-In directions (April 2022): 6-hour reporting to CERT-In for specific cybersecurity incidents (ransomware, specific data exfiltration, specific types). Separate + faster than DPDP 72-hour.
- SEBI (if listed company): LODR Reg 30 + specific material event disclosure if specific threshold crossed.
- RBI (if financial sector): specific banking + NBFC breach notification framework.
- IRDAI (if insurance): specific breach notification.
- TRAI / DoT (if telecom): specific breach notification.
- GDPR (if EU data principals affected): GDPR 72-hour notification to EU supervisory authority. Specific parallel compliance for foreign-origin companies.
- CCPA (if California residents): specific California breach notification law.
/ BQP urgent DPDP breach engagement
What we deliver.
- Immediate 24-48 hour engagement + breach severity triage.
- Legal notification drafting (DPB + data principal communications).
- Parallel regulator notification (CERT-In 6-hour + sector-specific).
- Co-ordination with foreign privacy counsel (GDPR / CCPA parallel if applicable).
- DPB investigation response preparation.
- Specific legal defence + Section 33 penalty mitigation strategy.
- Breach-response plan refresh post-incident.
- Data Protection Officer (DPO) interim support if SDF client.
- Specific data principal grievance management.
- TDSAT appeal if adverse DPB order.
Last updated: 2026-10-25.
/ Ready when you are
Personal data breach discovered?
72-hour DPDP notification + CERT-In 6-hour + parallel regulators + foreign privacy counsel coordination. BQP urgent engagement. WhatsApp +91 78018 87130.
FAQ
Common questions, answered.
Is DPDP 72-hour breach notification already mandatory?
DPDP Act 2023 Section 8(6) requires notification 'without delay'. Specific 72-hour window interpretation based on GDPR analogy + industry best practice. Specific Rules under finalisation (expected Budget 2026 notification) - exact timeline formally specified then. Prudent approach: 72-hour window regardless of final Rules.
What's the DPDP breach penalty exposure?
Up to INR 250 crore for failure to take reasonable security safeguards (Section 33 + Schedule). Up to INR 200 crore for failure to notify Data Protection Board. Separate penalties for children's data violations, SDF obligation failures. Appeal: TDSAT within 60 days.
Does CERT-In 6-hour reporting apply alongside DPDP 72-hour?
Yes - parallel compliance. CERT-In April 2022 directions: 6-hour reporting for specific cybersecurity incidents (ransomware, specific exfiltration). DPDP 72-hour: for personal data breach notification to Data Protection Board + data principals. Both apply if breach is both cyber incident + personal data breach.
Does BQP coordinate with foreign privacy counsel on DPDP + GDPR?
Yes - standard. For foreign-origin companies (US / UK / EU parent) with Indian subsidiary: GDPR 72-hour notification to EU supervisory authority + DPDP 72-hour notification in India + CCPA California notification if applicable. BQP + foreign privacy counsel + specific technical security + legal defence coordinated.
Does BQP handle urgent DPDP breach response?
Yes - specialist practice. 24-48 hour engagement + breach triage + legal notification drafting + parallel regulator coordination + foreign privacy counsel coordination + DPB investigation defence + Section 33 penalty mitigation + TDSAT appeal if adverse. For foreign + Indian companies. WhatsApp +91 78018 87130.
Related reading