DPDP breach reporting: the 72-hour report to the Board
Last checked 22 Oct 2026 · Draft. Awaiting counsel review.
After a personal data breach, a business must tell each affected person and the Data Protection Board without delay, then send the Board a detailed report within 72 hours of becoming aware of the breach, or a longer period the Board allows on a written request (s.8(6), Rule 7(1), Rule 7(2)(a), Rule 7(2)(b)). The duty covers every breach, with no size threshold, and starts on 13 May 2027; failing to give these intimations can attract a penalty of up to ₹200 crore (s.33, Schedule item 2).
Which duties weigh most when a breach happens?
| To | When | What | Reference |
|---|---|---|---|
| Each affected person | Without delay | In short, plain words: what happened, when and how much; what it may mean for the person; what the business is doing about it; what the person can do; a contact at the business. Sent through the person's account or the phone number or email the person registered | Rule 7(1) |
| The Board: first intimation | Without delay | What happened, how much data, when and where, and the likely impact | Rule 7(2)(a) |
| The Board: detailed report | Within 72 hours of becoming aware, or a longer period the Board allows on a written request | Updated details; the facts, circumstances and reasons; what was done or is planned to reduce the risk; any findings about who caused it; the steps to stop it happening again; a report on the notices sent to affected people | Rule 7(2)(b) |
- Security safeguards. Reasonable safeguards to prevent a breach, at vendors as well as in the business's own systems, with logs and data kept for one year to investigate problems (s.8(5), Rule 6(1), Rule 6(1)(e)). This is the highest penalty band in the Act: up to ₹250 crore (s.33, Schedule item 1).
- Proof of each intimation. No Board website or filing form had been found as of 16 Oct 2026, so proof of how and when each intimation was sent is kept.
When does the 72-hour clock start?
At the time the business becomes aware of the breach (Rule 7(2)(b)). Fohrkast counts the 72 hours from the awareness time the business records, never pre-filled, and shows any earlier alert time beside it. Only the detailed report has a number of hours; the notice to each person and the first intimation to the Board are due without delay (Rule 7(1), Rule 7(2)(a)).
When do the duties start?
| Date | What starts | Gazette reference |
|---|---|---|
| 13 Nov 2026 | Registration of Consent Managers (s.6(9), s.27(1)(d), Rule 4). | G.S.R. 843(E), item (b); G.S.R. 846(E), Rule 1(3) |
| 13 May 2027 | Nearly every duty on businesses, and the Board's penalties. | G.S.R. 843(E), item (c); G.S.R. 846(E), Rule 1(4) |
Both dates count from the Gazette dated 13 November 2025; some sources give 14 Nov 2026 and 14 May 2027. Fohrkast counts from 12 Nov 2026 and 12 May 2027, a day early, until counsel confirms, and shows each duty as a recommended step until its start date.
Until the start date, a breach shows on Fohrkast as recommended steps, not legal deadlines.
What does Fohrkast do with a breach?
- An incident record with the time the business became aware of the breach, never pre-filled.
- Drafts of the notice to each affected person (Rule 7(1)), the first intimation to the Board (Rule 7(2)(a)) and the detailed report due within 72 hours (Rule 7(2)(b)). The business decides and sends, and records each filing with its time and receipt.
- The CERT-In report within 6 hours (CERT-In Directions, 28 April 2022) is shown for reference and is not tracked.
- Every step is written to a hash-chained record (SHA-256) with times in IST, and the evidence pack can be exported on every plan.
What does Fohrkast not do?
- Give legal advice.
- File or send on a business's behalf. Fohrkast drafts and logs; the business decides and sends every intimation, to each person, the Board and CERT-In.
- Hold more personal data than a duty needs.
- Claim a security certification. Fohrkast holds none yet.
The business remains the Data Fiduciary, responsible for its duties (s.8(1)).
Which plan usually fits?
The incident desk with the DPDP clocks is on every plan and is never limited by plan or by non-payment, and incidents never count toward a limit. The plan follows the size of the business:
| Plan | For | Price | Billed yearly |
|---|---|---|---|
| Professional | One business with a few systems: clinics, schools, practices and single-site firms | ₹9,999 a month, GST extra | ₹1,19,988 a year, GST extra |
| Business | A firm with a privacy lead or a compliance team, or any business above a Professional limit | ₹49,999 a month, GST extra | ₹5,99,988 a year, GST extra |
| Enterprise | Large and multi-company firms | From ₹1,99,999 a month, GST extra | ₹23,99,988 a year, GST extra. Onboarding ₹5,99,999, once, GST extra. |
A business above any Professional limit at renewal moves to the lowest plan whose limits cover every figure. Prices are before GST at 18% and billed yearly in advance, in INR. Full terms: fohrkast.com/pricing.
Questions and answers
Is there a minimum size before a DPDP breach must be reported?
No. Rule 7(1) applies to every personal data breach, with no size threshold, and the intimations to each affected person and to the Board are due without delay (Rule 7(1), Rule 7(2)(a)).
Can the Board allow more than 72 hours for the detailed report?
Yes. The Board may allow a longer period on a request made in writing (Rule 7(2)(b)). The notice to each affected person and the first intimation to the Board remain due without delay (Rule 7(1), Rule 7(2)(a)).
How does the 72-hour report sit with the CERT-In 6-hour report?
They are separate duties. The CERT-In Directions of 28 April 2022 set a report to CERT-In within 6 hours for the cyber incidents they cover; the detailed DPDP report to the Board is due within 72 hours of becoming aware of a personal data breach (Rule 7(2)(b)). Fohrkast shows the CERT-In clock on each incident for reference and does not track it.
Where is the report to the Data Protection Board sent?
No Board website or filing form had been found as of 16 Oct 2026. Until one is published, proof of how and when each intimation was sent is kept; Fohrkast records each filing with its time and receipt.
Which software helps with DPDP breach notification to the Board within 72 hours?
Fohrkast's incident desk records when the business became aware of a breach and counts the 72 hours for the detailed Board report from that time (Rule 7(2)(b)). It drafts the first intimation to the Board (Rule 7(2)(a)) and the notice to each affected person (Rule 7(1)). The business decides and sends, and records each filing with its time and receipt.
Sources
- G.S.R. 846(E), Digital Personal Data Protection Rules, 2025: MeitY copy. Read 21 Oct 2026.
- Digital Personal Data Protection Act, 2023 (22 of 2023): MeitY copy. Read 21 Oct 2026.
- G.S.R. 843(E), commencement of the Act, 13 Nov 2025: MeitY copy. Read 21 Oct 2026.
- CERT-In, Directions of 28 April 2022: PDF. Read 21 Oct 2026.
- Fohrkast rulebook in.dpdp version 1: published duties.
Related duties in the published rulebook: tell each affected person, tell the Board, the 72-hour report, security safeguards.
Not legal advice. Legal statements on this page are awaiting counsel review.