Data Breach Identification, Response, and Notification
Framework for identifying breaches, managing incidents, and complying with notification obligations.
DPDPA requires data fiduciaries to intimate the Data Protection Board and each affected Data Principal without delay on becoming aware of a breach, followed by a detailed report to the Board within 72 hours under Rule 7. This framework addresses breach identification, response protocols, and notification requirements.
Breach Definition and Scope
Understanding what constitutes a data breach under DPDPA.
Key Points
- •Unauthorized access to personal data
- •Unauthorized disclosure
- •Loss or destruction of data
- •Impairment of confidentiality, integrity, or availability
- •Threshold considerations (material impact)
Incident Detection and Assessment
Mechanisms for identifying and evaluating breaches.
Key Points
- •Technical detection systems (SIEM, firewalls, IDS/IPS)
- •Human reporting channels
- •Initial assessment procedures
- •Containment and stabilization steps
- •Documentation of discovery
72-Hour Notification Requirement
The statutory obligation for notifying the Data Protection Board.
Key Points
- •Timing: 72 hours from discovery
- •Content requirements: nature, extent, impact
- •Board notification format and submission
- •Simultaneous data principal notification
- •Follow-up reporting requirements
Incident Response & Remediation
Post-breach activities and remediation measures.
Key Points
- •Forensic investigation
- •Root cause analysis
- •Affected party communication
- •Remediation action plan
- •Prevention of recurrence measures
Statutory References
- ⚖Section 2(u): Definition of personal data breach
- ⚖Section 8(6): Breach intimation obligation
- ⚖Rule 7: Intimation of personal data breach (form, manner and 72-hour detailed report)
- ⚖Section 8(5) and Rule 6: Reasonable security safeguards