The 72 hour report to the Data Protection Board (Rule 7): the clock, the contents, the start time

On becoming aware of a personal data breach, a business must tell each affected person and the Data Protection Board without delay, and then send the Board a detailed report within 72 hours of becoming aware, or within a longer period the Board allows on a written request s.8(6) Rule 7(1), 7(2)(a) and 7(2)(b). The duty covers every personal data breach, with no size threshold, and starts on 13 May 2027. Failing to give these intimations can attract a penalty of up to ₹200 crore s.33, Schedule item 2.

What counts as a personal data breach?

The Act defines it as "any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data" s.2(u).

The definition reaches beyond theft. An email sent to the wrong list, a lost phone holding customer numbers, a former employee who still has access, and ransomware that locks patient records (loss of access) can each be a personal data breach. Rule 7 sets no minimum number of people or level of harm before the duty applies.

What must be sent, to whom and when?

The notice to each person must be "concise, clear and plain", given "to the best of its knowledge", and sent "through her user account or any mode of communication registered by her" with the business Rule 7(1).

Only the detailed report has a number of hours. The notice to people and the first intimation to the Board are due "without delay", which can be well before 72 hours.

When does the 72 hour clock start?

At the moment the business becomes aware of the breach: the report is due "within seventy-two hours of becoming aware of the breach" Rule 7(2)(b). Neither the Act nor the Rules defines "aware".

In practice three times can differ: when a tool, a customer or a third party first raised an alert; when the business first noticed something was wrong; and when it became aware that personal data was affected. Recording all three, as they happen, lets the business show how it fixed the start of the clock. Fohrkast counts the 72 hours from the awareness time the business records, never prefilled, and shows any earlier alert time beside it. That count is Fohrkast's reading.

Can the Board allow more time?

Yes. Rule 7(2)(b) allows "such longer period as the Board may allow on a request made in writing in this behalf". The text does not say when the request must be made. A request made, and kept on record, before the 72 hours run out leaves the least room for dispute.

Where is the report sent?

On 21 October 2026 Fohrkast could not find a Data Protection Board website or a filing form. The Rules make the Board a digital office (Rule 20), so an online route is expected. Until one is published, keep proof of how and when each intimation was sent.

How does this sit with the CERT-In six hours?

They are two separate duties. The CERT-In Directions of 28 April 2022, issued under s.70B(6) of the Information Technology Act, 2000, require service providers, intermediaries, data centres, body corporates and government organisations to report the cyber incidents listed in their Annexure I to CERT-In "within 6 hours of noticing such incidents or being brought to notice about such incidents" (direction (ii)). That duty applies today, whether or not personal data is involved.

One incident can trigger both: a report to CERT-In within 6 hours, and the DPDP intimations to people and the Board, with the detailed Board report within 72 hours. Each has its own recipient, trigger and contents.

When does Rule 7 start?

Rule 7 starts with the main tranche of the Rules, eighteen months after publication in the Official Gazette (Rule 1(4)), and s.8(6) and the penalties in s.33 start the same day G.S.R. 843(E), item (c). Counted from the printed Gazette date, that is 13 May 2027; some sources count from 14 November 2025 and give 14 May 2027. The DPDP dates post explains the difference.

Until then, Fohrkast shows the Rule 7 steps on an incident as recommended steps, not legal deadlines.

What does Fohrkast do with a breach?

• Any seat from front desk upward can report an incident, with its type, when it was first noticed, any earlier alert, and the awareness time.
• Fohrkast counts the deadlines from the awareness time and alerts the people holding each contact role by email and in the app; an alert not acknowledged in time goes to the administrators.
• It drafts the notice to affected people (Rule 7(1)) and the report pack for the Board. The business edits each text and releases it only with a recent authenticator code.
• The list of affected people is generated by the scanner inside the business's own environment; Fohrkast holds counts only.
• For each recipient, the administrator or privacy lead records the filing: stage, channel, time sent in IST, an optional reference number and an optional receipt.
• A drill runs the same deadlines with no filing made.

The business decides and sends each intimation, and files with the Board and CERT-In; Fohrkast drafts each intimation and records each filing the business logs. Each incident carries the CERT-In 6 hour clock, with email alerts and a drafted report for the business to send.

Fohrkast dates each of these duties for the business and keeps the evidence. Request access »