A Personal Data Breach: The First 72 Hours under the DPDP Rules and the CERT-In Directions

When an Indian business discovers that personal data has been accessed, leaked or lost, two regulatory clocks can start at once. One has run since 2022. The other starts with the substantive provisions of the Digital Personal Data Protection Act on 13 May 2027.

The two clocks

• CERT-In: six hours. The CERT-In Directions of 28 April 2022, issued under section 70B of the Information Technology Act, require service providers, intermediaries, data centres, body corporates and government organisations to report specified cyber incidents, including data breaches and data leaks, within six hours of noticing them. They also require ICT system logs to be kept for 180 days.
• DPDP Rules: without delay, and 72 hours. Rule 7 of the DPDP Rules, 2025 requires a Data Fiduciary to inform the Data Protection Board and each affected Data Principal of a personal data breach without delay, and to send the Board a detailed report within 72 hours of becoming aware of it, unless the Board allows longer.

Businesses in some sectors, such as banking and insurance, have further reporting duties of their own, often within hours. Contracts may also require notice to customers or, for a processor, to the business it processes data for.

Hours 0 to 6: contain, preserve, report

1. Contain the incident without destroying evidence: isolate affected systems, revoke compromised credentials, and stop the leak.
2. Preserve evidence: logs, images of affected systems and a timeline, with a record of who handled what. Electronic evidence must later meet the Bharatiya Sakshya Adhiniyam, 2023.
3. Convene the response team: IT and security, legal, management, communications, and outside forensic experts if needed.
4. Report to CERT-In if the incident is reportable. An initial report can be followed by updates; waiting for certainty is not an option.

Hours 6 to 24: understand and decide

• Work out what data was affected, whose, how much and how sensitive. Children’s data, financial data and health data raise the stakes.
• Decide who must be told: the Board, affected people, any authority in the sector, customers under contract, insurers under the policy.
• Bring lawyers in early. Communications with legal advisers made to obtain legal advice are protected from disclosure under the law of evidence, which helps while the facts are still being established.

Hours 24 to 72: notify and report

Under the DPDP Rules, the notice to each affected person must be in plain language and describe the breach, including its nature, extent, timing and location; its likely consequences; the mitigation measures taken; the safety measures the person can take; and the contact details of someone who can answer their questions. The detailed report to the Board must cover the broad facts and the reasons for the breach, the mitigation measures, any findings about the person who caused it, the remedial measures taken to prevent it happening again, and a report on the notices given to affected people.

What is at stake

Under the DPDP Act, the Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach, and up to ₹200 crore for failing to notify the Board or affected people. Until the Act’s substantive provisions commence, section 43A of the IT Act already allows compensation claims for negligent failures to protect sensitive personal data.

Prepare now

1. Write a breach response plan with named people, phone numbers and decision rights.
2. Draft template notices for CERT-In, the Board and affected people.
3. Check that logs are kept for at least 180 days (CERT-In), and for a year as the DPDP Rules will require.
4. Put breach notice clauses into every processor and vendor contract.
5. Run a tabletop exercise at least once a year.

See also The DPDP Rules, 2025: what applies when, our DPDP FAQs and our data protection practice.

This article is for general information and states the law as at 12 October 2026. It is not legal advice. For advice on your situation, contact the firm. Published by BRB Legal.