What has to happen if there is a data breach?

The Data Fiduciary must notify the Data Protection Board and each affected Data Principal, in the form and manner prescribed. The obligation is not limited to large or malicious breaches: any personal data breach, meaning unauthorised processing, accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access that compromises confidentiality, integrity or availability, falls within it. Note that separate reporting duties may run in parallel. All regulators impose their own incident reporting timelines. Organisations should have a documented incident response plan that accounts for every reporting obligation that applies to them, not just the DPDP one.