Request a callback

Glossary · DPDP Act 2023 · s. 2(u), s. 8(6)

Personal data breach

Definition

DPDP Act 2023 · s. 2(u), s. 8(6)

Any unauthorised processing of personal data, or an accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to it, that compromises its confidentiality, integrity or availability; a ransomware attack that only locks data counts. You must intimate the Board and each affected Data Principal (s. 8(6)); Rule 7 of the DPDP Rules 2025 requires both without delay and a fuller report to the Board within 72 hours, or a longer period the Board allows. The penalty for failing to notify is up to Rs 200 crore.

"personal data breach" means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data.
Also called data breachsecurity breach
Read the source

Sources: DPDP Act 2023, s. 2(u) and s. 8(6); DPDP Rules 2025, Rule 7; GDPR, Art. 4(12) and Art. 33

In other laws

LawTermNote
GDPR (EU)Personal data breach, Art. 4(12)Notify the supervisory authority within 72 hours unless the breach is unlikely to result in a risk (Art. 33), and individuals only where the risk is high (Art. 34). DPDP has no risk threshold.
CERT-In Directions 2022Cyber security incidentReport to CERT-In within 6 hours of noticing. A separate clock that runs alongside DPDP's, and covers incidents with no personal data.

Where it appears

s. 8(6)

Intimate the Board and each affected Data Principal

Sch.

Penalty for failure to notify, up to Rs 200 crore

Related terms

Cyber security incident (CERT-In)Data Protection Board of IndiaData FiduciaryProcessing

This page explains the law in plain English. It is not legal advice.