Quick answer
Under section 8(6) of the Digital Personal Data Protection Act, 2023, a Data Fiduciary must inform the Data Protection Board and each affected person when a personal data breach occurs. The DPDP Rules, 2025 set the timelines, including a detailed report to the Board within 72 hours unless it allows longer. Most duties apply from 13 May 2027, so staff reporting habits need building now.
Key takeaways
- A personal data breach is not only a hack. A misdirected email, a lost laptop or an over-shared spreadsheet can qualify if personal data is exposed, altered or lost.
- The DPDP Act requires the Data Fiduciary to notify the Data Protection Board and each affected Data Principal, and the Rules set the timing and content of the notices.
- The Act’s penalty schedule runs up to Rs 250 crore for failing to take reasonable security safeguards and up to Rs 200 crore for failing to give breach notice.
- The legal clock effectively starts when the first employee notices, so how quickly staff report matters more than how good your incident plan looks on paper.
- Most duties under the DPDP Rules, 2025 apply from 13 May 2027, which leaves a practical window to train people and test the process.
When people think about a data breach, they picture hackers and ransomware. In daily practice, most reportable incidents begin with an ordinary mistake and a person who is unsure whether it is “serious enough” to mention. Under the DPDP framework, that hesitation is where the compliance risk sits.
What counts as a personal data breach under the DPDP Act?
The Digital Personal Data Protection Act, 2023 defines a personal data breach broadly: any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to it, that compromises its confidentiality, integrity or availability. The test is the effect on the data, not the cause of the incident.
That means a stolen phone with unencrypted customer contacts, a vendor who emails the wrong invoice file, and a shared drive left open to the whole company can all be breaches. Whether a particular incident needs notification depends on the facts, and your legal or privacy team should make that call, which is exactly why they must hear about it quickly.
What must a company do when a breach happens?
Section 8(6) of the Act requires the Data Fiduciary to intimate the Data Protection Board of India and each affected Data Principal. The DPDP Rules, 2025, notified by MeitY, add the detail: affected individuals are told without delay, and the Board receives an initial intimation without delay and a more detailed report within 72 hours, or a longer period if the Board permits. Confirm the exact wording of the Rules with counsel before you finalise your procedure.
| Duty | Who it is owed to | Timing under the Rules |
|---|---|---|
| Intimate the breach | Data Protection Board of India | Without delay, then a detailed report within 72 hours unless the Board allows longer |
| Inform affected people | Each affected Data Principal | Without delay, in plain language, with what happened and what they can do |
| Reasonable security safeguards | Applies throughout, to prevent breaches | Ongoing; penalty up to Rs 250 crore for failure under the Act’s Schedule |
| Failure to give breach notice | Penalty exposure under the Schedule | Up to Rs 200 crore under the Act’s Schedule |
Why does employee reporting decide whether you meet the deadline?
Because the 72-hour window is measured against the organisation, not against the moment your privacy team learns of the incident. If a sales executive loses a laptop on Friday evening and reports it on Tuesday, most of your reporting window may already be gone before anyone with authority can assess it.
Why Reports Come Late
- “It was just a small mistake”
- Fear of blame or a disciplinary note
- No one knows who to call after hours
- Breach seen as an IT problem only
- Vendors do not tell you until much later
- The policy is a PDF nobody has opened
What Fast Reporting Looks Like
- Staff know that any exposure of personal data is reportable
- A no-blame rule for prompt self-reporting
- One mailbox and one phone number, monitored daily
- Legal, IT, HR and the business involved from hour one
- Vendor contracts with a fixed notice period
- Short drills that people actually remember
Which everyday incidents do employees fail to flag?
Misdirected emails and wrong attachments
Sending salary, KYC or health-related files to the wrong recipient is the most common incident. Recalling the email does not undo the disclosure, and the person who made the mistake is rarely the right person to judge its seriousness.
Lost devices and shared accounts
Laptops, phones and pen drives hold customer and employee data. A lost device should be reported immediately, whether or not it was encrypted, so that the team can check what it held.
Over-shared files and vendor mistakes
Spreadsheets shared with “anyone with the link”, and processors who expose your data, both count. Vendors acting for you on personal data should be bound by contract to tell you quickly. Our guide on why employees are the biggest DPDP gap explains how these habits connect to the wider obligation.
How do you build breach readiness before May 2027?
Write a one-page employee playbook
State what to report, how, and to whom, in plain language. Keep it to one page, and put the contact on the intranet home page and on the back of ID cards.
Adopt a no-blame rule for prompt reporting
Penalising honest mistakes teaches people to hide them. Reserve disciplinary action for concealment, not for the original error.
Rehearse once a quarter
Run a short tabletop drill: a misdirected spreadsheet, a lost laptop, a vendor alert. Time how long it takes for the right people to be in the room, and fix the slowest step.
Train by role
All staff need to recognise and report an incident; privacy, legal and IT teams need to assess and notify. Our DPDP Essentials course covers the first group and DPDP Compliance Pro the second. The DPDP training hub collects the related guides.
What should you do this month?
Ask ten employees from different functions what they would do if they emailed a personal data file to the wrong person. If fewer than eight can name the right contact within a few seconds, your reporting chain is the weak link, and that is a far cheaper gap to close now than after the Rules take full effect.
Frequently asked questions
Is every data incident a reportable personal data breach?
No. The Act defines a breach by its effect on personal data, and not every incident will need notice to the Board. Employees should report everything promptly and let the privacy or legal team decide.
What is the DPDP breach reporting deadline?
Under the DPDP Rules, 2025, the Board is told without delay and sent a detailed report within 72 hours, unless it allows more time. Affected individuals are informed without delay. Check the Rules text with counsel.
When do the DPDP breach obligations start applying?
Most Data Fiduciary duties under the DPDP Rules, 2025 apply from 13 May 2027, 18 months after notification on 13 November 2025.
Who is responsible if a vendor causes the breach?
The Data Fiduciary stays responsible for personal data processed on its behalf. Contracts with processors should require prompt notice of incidents and cooperation with your response.
What are the penalties for DPDP breach failures?
The Act’s Schedule provides for penalties up to Rs 250 crore for failure to take reasonable security safeguards and up to Rs 200 crore for failure to give breach notice. The Board decides the amount after an inquiry.
Sources
Make sure the first person to see a breach knows what to do next.
See how role-based DPDP training helps your teams recognise, report and respond to personal data incidents before the Rules take full effect. Book a walk-through with our team.
Request Demo