DPDP data breach notification: what to send, to whom, by when
A personal data breach is any unauthorised processing, accidental disclosure, sharing, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability (section 2(u)). From 13 May 2027, every breach must be intimated, whatever its size (section 8(6), Rule 7).
To each affected person, without delay (Rule 7(1))
In a concise, clear and plain way, through their user account or the contact they registered with you:
- what happened: the nature and extent of the breach and when it occurred;
- the consequences likely for them;
- what you have done and are doing to reduce the risk;
- what they can do to protect themselves;
- who answers their questions for you, with business contact details.
To the Data Protection Board, in two steps (Rule 7(2))
- Without delay: a description of the breach, its nature, extent, timing and location, and the likely impact.
- Within 72 hours of becoming aware of the breach, or a longer period the Board allows on a written request: updated and detailed information, the facts and reasons that led to the breach, the measures taken or proposed, any findings about who caused it, what you do to prevent it happening again, and a report on the messages sent to the people affected.
Work out your 72-hour deadline
The calculator needs JavaScript. Without it, add 72 hours to the moment you became aware of the breach.
Write the breach message and the Board draft
Questions
Is there a minimum size for a breach to be intimated?
No. Rule 7 applies to any personal data breach; neither the Act nor the Rules set a threshold.
What if the breach happened at our vendor?
You stay responsible for processing done on your behalf by a Data Processor (section 8(1)), so you intimate the Board and the people affected.
Can we get more time?
Only for the detailed report: the Board may allow a longer period on a request made in writing (Rule 7(2)). The first intimation is still due without delay.
Read in the Act and the Rules on 28 October 2026. This is not legal advice.