India AI RulebookData-breach response — what to do, and the clocks that start
Two clocks start the moment you become aware of a personal data breach: an immediate 'without delay' duty to tell every affected user and to give the Board a first description, and a 72-hour deadline for the detailed report to the Board.
Checked against primary sources where marked. Items marked Confirmation pending are not yet checked. See the list
In plain English
Two steps to the Board
Law — s.8(6), DPDP Act 2023; Rule 7, DPDP Rules 2025 (G.S.R. 846(E), 13 November 2025): on becoming aware of a breach, tell affected users without delay (Rule 7(1)). Give the Board an initial description without delay (Rule 7(2)(a)). Send the fuller Board report within 72 hours of awareness (Rule 7(2)(b)). The Board may allow longer on a written request.
Good practice for vendors: alert your client as soon as you become aware of a breach. Do not wait for confirmation or a full report. Put this alert duty in your contract. Rule 7 sets the Fiduciary's reporting duties, not a separate vendor clock.
s.8(6); Rule 7(1), (2)(a), (b) — Act · Rules PDF page 26 · CorrigendaThe clock starts when you become aware of the breach. It does not start when you finish investigating it. From that moment, a Data Fiduciary must tell every affected Data Principal without delay, in plain language. You must cover five specific things:
- What happened.
- What it means for them.
- What you are doing about it.
- What they can do.
- Who to contact.
The Board gets two messages: a first description without delay, then a detailed report within 72 hours. The Board can extend that deadline only if you make a written request and it agrees. There is no size threshold and no "minor breach" exemption — any personal data breach triggers both duties.
Think of it like
Think of a fire in an apartment block. You pull the alarm right away so residents can get out and protect themselves. You do not wait to work out which wire shorted. The fire department gets a quick call first, then a full written report once you know the cause.
Key takeaways
- Awareness starts the clock. Both the user notice and the first Board notice are due "without delay", not after the investigation closes.
- The user notice must cover five things under Rule 7(1)(a)–(e). One of these is a named business contact who can answer questions.
- Notice must reach each affected user through her user account or a way she registered with you. A blog post or press release does not count as notice.
- The Board's detailed report under Rule 7(2)(b) is due within 72 hours of awareness. It must cover:
- The causes.
- Mitigation steps.
- Who caused it.
- Remedial steps.
- Proof you told affected users.
- A longer period is possible only if the Board allows it on a written request. Assume 72 hours until it does.
- Section 8(6) is the statutory hook. Rule 7 is the prescribed form and manner. Section 8(7)–(8) keeps the erasure duty running alongside.
What this means for you
Write the breach runbook and the five-point user notice template now. Name the contact person too — you cannot draft this in the middle of an incident.
Good practice: your contract should require alerts as soon as you become aware of a breach. Do not wait for full facts. The client's Rule 7(2)(b) clock runs from awareness.
If your list, membership, or community platform leaks subscriber data, you owe each subscriber a direct plain-language notice. A public post is not enough.
Status
Primary sources
Official text
Official text — Rule 7, DPDP Rules, 2025
Official text — Section 8(6)–(8), DPDP Act, 2023
DPDP readiness checklist
Check whether your breach runbook, contact point, and erasure workflow are actually in place.
Run it nowCitation
Kokate, S. (2026). Data-breach response — what to do, and the clocks that start. India AI Rulebook. Retrieved from https://indiaairulebook.com/learn/data-privacy/breach-response. Educational content, not legal advice.