When something goes wrong
Personal data breaches and the 72-hour report
Read this chapter
The same material as the video, step by step. Each diagram animates as you reach it.
A breach is more than hacking
A breach is any unauthorised processing, or accidental disclosure, change, loss of access or destruction of personal data that harms its confidentiality, integrity or availability.
The definition covers all three security goals: confidentiality (exposure), integrity (unauthorised change) and availability (loss of access, as in ransomware). An insider misusing access counts as unauthorised processing.
No threshold
Unlike some laws, the Act has no risk threshold. Report every breach, to the Board and to every affected person.
Under the GDPR you can skip notifying the regulator when a breach is unlikely to cause risk. The DPDP Act does not have this filter. Expect a higher volume of reports, and design your process to handle small incidents quickly.
Two reporting tracks
Report on two tracks at once. Tell affected people without delay. Tell the Board without delay, then send a detailed report within 72 hours.
The Board may allow more time than 72 hours if you ask in writing. The 72 hours run from when you become aware of the breach, so detection and escalation speed matter. Separately, CERT-In's 2022 directions require many cyber incidents to be reported within 6 hours; that duty continues alongside DPDP.
What to tell affected people
Tell people in clear and plain language, through their user account or the contact details you have.
The Rules require the message to be concise, clear and plain. Write templates in advance, in the languages your customers use, and decide which channels (email, SMS, in-app) you will use.
What goes in the 72-hour report
The detailed report to the Board needs facts, causes, fixes and evidence that you told the people affected.
Logs kept under Rule 6 are what make this report possible. Without access logs you cannot say what was exposed or who caused it, which weakens your position on penalties.
What a breach can cost
These are separate penalties. Weak security that caused the breach can cost up to ₹250 crore, and failing to report it up to ₹200 crore more.
These are maximums per instance. The Board decides the actual amount after an inquiry, considering factors such as gravity, duration, the type of data, repetition, gain made or loss avoided, and how quickly you acted to reduce harm (s.33(2)).
Be ready before it happens
You cannot write a 72-hour report from scratch during a crisis. Prepare now.
Map overlapping duties in one playbook: DPDP (Board and people), CERT-In (6 hours), sector regulators such as RBI, SEBI or IRDAI, and contractual notices to business customers.
In one line
Next: the extra protections for children and persons with disability.