The 72-Hour Clock Starts Immediately
Section 8(6) of the DPDPA imposes an unambiguous obligation: every Data Fiduciary must notify the Data Protection Board and each affected Data Principal of any personal data breach. The notification must be in such form and manner as may be prescribed. Rule 7 prescribes the form. The timeline — while not explicitly stated as 72 hours in the Act — is clarified through the Rules to require notification "without unreasonable delay."
What Constitutes a Breach Under DPDPA
A "personal data breach" under Section 2(u) means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data. This definition is broader than GDPR's — it includes "unauthorised processing," which captures internal misuse by employees, not just external attacks.
Notification Protocol for Foreign Companies
Foreign companies face specific operational challenges. If the breach occurs in a data centre outside India but involves personal data of Data Principals within the territory of India, the notification obligation still applies. The Data Protection Board must be notified regardless of where the breach physically occurred.
Step 1: Identify and Contain (Hours 0-6)
Immediately upon becoming aware of a breach affecting Indian personal data: (a) activate your incident response team, (b) determine the scope — how many Indian Data Principals are affected, (c) contain the breach to prevent further exposure, (d) preserve forensic evidence. Document everything from this point — the Board may request evidence of your response timeline.
Step 2: Classify and Assess (Hours 6-24)
Classify the breach against the Rule 7 categories. Determine: the nature and quantity of personal data affected, the categories of Data Principals affected (especially whether children's data under Section 9 is involved — this escalates severity), the likely consequences for affected individuals, and whether the data was encrypted or otherwise protected.
Step 3: Notify the Board (Hours 24-48)
Prepare the notification in the form prescribed under Rule 7. Include: a description of the breach, the approximate number of Data Principals affected, the personal data categories involved, the likely consequences, the measures taken to address and mitigate the breach, and contact details for the Data Protection Officer or designated contact person.
Step 4: Notify Data Principals (Hours 48-72)
Each affected Data Principal must be individually notified. The notification must be in clear and plain language, must describe the nature of the breach, and must include measures the Data Principal can take to protect themselves. For foreign companies with large Indian user bases, this requires a scalable notification mechanism — email, in-app notification, or other verifiable channel.
Penalties for Failure to Notify
Under the Schedule to the DPDPA, failure to notify a breach attracts a penalty of up to ₹200 crore. This is a separate penalty from any penalty for the underlying security failure that caused the breach. A company that suffers a breach due to inadequate security (Section 8(4)) AND fails to notify faces cumulative penalties.
Cross-Border Coordination
If the same breach triggers notification obligations under both GDPR and DPDPA, the notifications must be prepared separately. The GDPR 72-hour notification to the supervisory authority and the DPDPA notification to the Board are independent obligations with different content requirements. A single notification document will not satisfy both regimes.