DPDP Rules 2025 · Rule 7 · Group CUpcoming · 13 May 2027

Intimation of personal data breach

Status: Upcoming
Applies from: 13 May 2027Rule 1(4)
Penalty: Up to Rs 200 croreAct, Schedule, item 2
Binds: Every Data Fiduciary

In plain English

Sets the two-track breach intimation that s. 8(6) of the Act requires. To each affected person: without delay, through their user account or any registered mode of communication, a concise and plain description of the breach (nature, extent, timing), the consequences likely for them, what you have done and are doing to mitigate risk, what they can do to protect themselves, and a contact who can answer questions.

To the Data Protection Board: without delay, a description of the breach including nature, extent, timing, location and likely impact; then within 72 hours of becoming aware (or longer if the Board allows on a written request), the detailed report: updated description, the facts and reasons behind the breach, mitigation measures, findings about who caused it, remedial measures to prevent recurrence, and a report on the intimations given to affected people.

There is no threshold: every personal data breach, however small, triggers both notices. This sits alongside the CERT-In six-hour incident reporting direction of 2022, which runs on a different clock and to a different authority.

What you must do

Write the breach runbook now: who decides "aware", who drafts the user notice, who files the initial Board notice and the 72-hour report.
Free toolOpen the clock
Keep a reachable registered mode of communication for every user so intimation can go out without delay.
Free toolOpen the clock
Map the DPDP 72-hour report against the CERT-In 6-hour report and any sector regulator (SEBI CSCRF, RBI) so one incident produces every filing on time.
Free toolOpen the clock

Links marked Product, Service or Free tool are Infofacility's own.

Gazette text · Rule 7On becoming aware of any personal data breach, the Data Fiduciary shall, to the best of its knowledge, intimate to each affected Data Principal, in a concise, clear and plain manner and without delay, through her user account or any mode of communication registered by her with the Data Fiduciary, —

(1)
On becoming aware of any personal data breach, the Data Fiduciary shall, to the best of its knowledge, intimate to each affected Data Principal, in a concise, clear and plain manner and without delay, through her user account or any mode of communication registered by her with the Data Fiduciary, —
1. (a)
  a description of the breach, including its nature, extent and the timing of its occurrence;
2. (b)
  the consequences relevant to her, that are likely to arise from the breach;
3. (c)
  the measures implemented and being implemented by the Data Fiduciary, if any, to mitigate risk;
4. (d)
  the safety measures that she may take to protect her interests; and
5. (e)
  business contact information of a person who is able to respond on behalf of the Data Fiduciary, to queries, if any, of the Data Principal.
(2)
On becoming aware of any personal data breach, the Data Fiduciary shall intimate to the Board, —
1. (a)
  without delay, a description of the breach, including its nature, extent, timing and location of occurrence and the likely impact;
2. (b)
  within seventy-two hours of becoming aware of the breach, or within such longer period as the Board may allow on a request made in writing in this behalf, —
  1. (i)
    updated and detailed information in respect of such description;
  2. (ii)
    the broad facts related to the events, circumstances and reasons leading to the breach;
  3. (iii)
    measures implemented or proposed, if any, to mitigate risk;
  4. (iv)
    any findings regarding the person who caused the breach;
  5. (v)
    remedial measures taken to prevent recurrence of such breach; and
  6. (vi)
    a report regarding the intimations given to affected Data Principals.

Source: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy)

Act sections and tools that apply

DPDP Act 2023, s. 8: General obligations of Data FiduciaryBreach notification clockCERT-In directions vs DPDP breach rulesGlossary: Personal data breach

Source: Gazette of India, G.S.R. 846(E), 13 Nov 2025 (MeitY copy) · Change log