The DPDP breach notification timeline
In short
Rule 7 creates two separate intimations, and both start from the same moment: the point at which the Data Fiduciary becomes aware of the personal data breach.
- To each affected Data Principal. Without delay, through her user account or a mode of communication she has registered, in concise, clear and plain language.
- To the Data Protection Board. Without delay, a description of the breach. Then, within seventy two hours of becoming aware, or within a longer period the Board allows on a written request, a detailed report.
Seventy two hours is the only numbered window in Rule 7. Everything else is measured as "without delay".
01What goes to the affected Data Principal
Rule 7(1) lists five items, and the intimation is owed to each affected Data Principal individually rather than by public notice.
| Item | Content |
|---|---|
| (a) | A description of the breach, including its nature, extent and the timing of its occurrence |
| (b) | The consequences relevant to her that are likely to arise from the breach |
| (c) | Measures implemented and being implemented to mitigate risk |
| (d) | The safety measures she may take to protect her interests |
| (e) | Business contact information of a person who can respond to her queries |
Two operational consequences follow immediately. First, the Data Fiduciary must be able to enumerate who was affected, which is a data mapping problem rather than a legal one. Second, it must have a delivery channel that works at volume on the day, through the user account or a registered mode of communication. Lawful mass notification by SMS in India requires a template already registered on the DLT platform, and that registration is not instantaneous.
02What goes to the Board, and when
Rule 7(2) splits the Board intimation into an immediate part and a detailed part.
| Stage | Timing | Content |
|---|---|---|
| Initial | Without delay | Description of the breach: nature, extent, timing and location of occurrence, and the likely impact |
| Detailed | 72 hours | Updated and detailed description; the broad facts, circumstances and reasons leading to the breach; measures implemented or proposed to mitigate risk; findings on the person who caused the breach; remedial measures to prevent recurrence; and a report on the intimations given to affected Data Principals |
The seventy two hour period runs from becoming aware of the breach, not from the initial intimation. A longer period is available only if the Board allows it on a request made in writing. There is no automatic extension, and a request made at hour seventy is not a plan.
03Where the clock starts, and the two ways to get it wrong
The window runs from the point the organisation becomes aware that a personal data breach has occurred. That is the anchor, and it is the single most contested timestamp in any real incident.
Teams get it wrong in both directions. The first error is anchoring late, treating awareness as beginning when forensics confirmed the finding rather than when the organisation knew a personal data breach had occurred. The second error is the mirror image: on learning that the intrusion began eleven days earlier, re-anchoring the clock to the date of first unauthorised access. The intrusion start date is not the awareness date. It is highly relevant to the detailed report, and it does not move the seventy two hours.
Record the moment awareness was established, who established it and on what basis, contemporaneously. That record is the first thing an inquiry will ask for.
04When Rule 7 applies
Rule 7 falls in the Rule 1(4) group, which comes into force eighteen months after publication of the notification of 13 November 2025.
This does not leave a gap in the meantime. The CERT-In Directions of April 2022 already require reporting of specified cyber incidents within six hours of noticing or being brought to notice, and sectoral obligations under the RBI, SEBI and IRDAI frameworks apply to regulated entities today. The practical question is not whether an obligation exists, but how many run at once.
05The evidence Rule 6 expects you to still have
Rule 6 on reasonable security safeguards is what makes the Rule 7 report answerable. It requires, at a minimum, encryption, obfuscation, masking or virtual tokens; access control on the computer resources used by the Data Fiduciary or its Data Processor; visibility over access through logs, monitoring and review; measures for continued processing such as backups; retention of those logs and personal data for one year unless another law requires otherwise; a contractual safeguard obligation on the Data Processor; and appropriate technical and organisational measures.
The one year log retention floor is the provision most often missed, and it is the provision that determines whether the broad facts, circumstances and reasons required by Rule 7(2)(b) can be established at all.
06Common questions
Does DPDP give seventy two hours to notify affected individuals?
No. The seventy two hour window applies to the detailed report to the Data Protection Board. Intimation to each affected Data Principal is owed without delay under Rule 7(1).
When does the seventy two hours start?
On becoming aware of the personal data breach. Not at the start of the intrusion, and not at the point forensics conclude.
Can the deadline be extended?
The Board may allow a longer period on a request made in writing. The Rule provides no automatic extension.
Does a Data Processor's delay in telling us reduce our obligation?
No. The obligation in Rule 7 sits on the Data Fiduciary. A slow processor compresses the time available; it does not move the deadline.
Ask an AI assistant about this page
Each button opens the assistant with the prompt below already written.
Answers are generated by third party systems and are not published or verified by this site. Check anything load bearing against the gazette text.