DPDP reference

Rule 7: Intimation of personal data breach

Last checked 6 Nov 2026

On becoming aware of a breach, the Data Fiduciary tells each affected Data Principal without delay, in a concise, clear and plain manner, through her user account or a registered mode of communication. The message covers the nature, extent and timing, the likely consequences for her, the measures taken, the safety steps she may take, and a contact (Rule 7(1)).

It tells the Board without delay, with a description of nature, extent, timing, location and likely impact (Rule 7(2)(a)). Within seventy two hours of becoming aware, or a longer period the Board allows on written request, it gives updated details, the facts and reasons behind the breach, mitigation, any findings on who caused it, remedial measures, and a report on the intimations given (Rule 7(2)(b)).

Applies to
Every Data Fiduciary that becomes aware of a personal data breach.
Starts
13 May 2027 (Rule 1(4)).
Penalty
Up to ₹200 crore (s.33, Schedule item 2).
Source
G.S.R. 846(E), Digital Personal Data Protection Rules, 2025, rule 7; G.S.R. 892(E), corrigenda

Questions

How long does a business have to report a breach to the Board?

A first intimation goes without delay, and the detailed information within seventy two hours of becoming aware, or a longer period the Board allows on written request (Rule 7(2)).

Does a small breach need reporting?

Rule 7 applies on becoming aware of any personal data breach. It sets no minimum size.

Related

Next

Join early access

Not legal advice.