A data breach can disrupt operations and put personal information at risk. Under India’s Digital Personal Data Protection (DPDP) framework, businesses will need to follow specific breach-notification requirements, including a 72-hour deadline for submitting detailed information to the Data Protection Board once the relevant Rules take effect. Preparing now can help businesses respond more effectively when a breach occurs.
As part of our DPDP series, explore our previous articles covering the DPDP Act, key roles and responsibilities, the compliance roadmap, and breach response requirements.
Ashok runs a 40-person IT services company in Chennai, the same business we followed through the compliance roadmap. Here, we follow what happens after a support engineer’s laptop, with access to client backup credentials, gets stolen from a car.
The 72-hour clock: what it actually covers
The 72-hour deadline under Rule 7 of the DPDP Rules, 2025, applies to submitting detailed information about a personal data breach to the Data Protection Board. This requirement is scheduled to commence in May 2027.
The Rules also require the Data Fiduciary to notify the Board without delay when it becomes aware of a personal data breach. The detailed report must follow within 72 hours, unless the Board allows a longer period on a written request. Businesses should prepare for both stages rather than treating 72 hours as the time available before making any notification.
The clock starts at awareness, not suspicion
The reporting timeline is linked to when the Data Fiduciary becomes aware of a personal data breach. Businesses should not wait for a complete investigation before escalating a suspected incident, assessing potential exposure, and taking appropriate containment measures. The facts available at the time will determine the next steps, and the investigation can continue as further information emerges.
For Ashok’s team, awareness arrived when the employee reported the laptop stolen and IT confirmed it had live access to client backup credentials. That is when Ashok’s team recognises the potential exposure and begins its incident-response process. The applicable reporting timeline must be assessed based on when the business becomes aware of a personal data breach.
Two recipients, two different clocks
DPDP Rule 7 sets out notification requirements for two recipients: the Data Protection Board and each affected Data Principal. The requirements are related, but the information and timing differ for each recipient.
To the Board: an initial notification is expected without delay, covering the nature, extent, timing, and likely impact of the breach as far as you know it at that point. This is followed by a detailed report, generally within 72 hours of awareness, unless the Board grants a longer period after a formal, written, justified request. That detailed report typically needs to cover the broad facts and causes of the breach, mitigation steps taken or proposed, any findings on who was responsible, steps to prevent recurrence, and a summary of how affected individuals were notified.
To affected Data Principals: every individual whose personal data was involved needs to be told, in plain language, what happened, which categories of their data were involved, the likely consequences for them personally, concrete steps they can take to protect themselves, and contact details for a named person at your business who can answer questions.
It isn’t fully settled in public guidance whether the Board must be notified strictly before affected individuals, or whether the two can happen in parallel. Confirm this specific sequencing with legal counsel or the Board’s own guidance closer to enforcement. What is certain either way: both notifications are required for every breach, regardless of severity.
The single biggest difference from GDPR
If you have any GDPR experience, this is the detail most likely to catch you out. GDPR uses a risk-based threshold: notifying individuals is only required if the breach is likely to result in high risk to their rights and freedoms. Businesses assess severity and decide.
Under the DPDP Rules, there is no equivalent risk-based threshold for notifying affected individuals. Once the relevant breach-notification provisions commence, a Data Fiduciary must notify affected Data Principals without delay when a personal data breach occurs, regardless of its severity. A breach affecting ten records carries the identical notification obligation as one affecting ten million. Every breach gets notified, to both the Board and every affected individual, full stop. Read more about GDPR vs DPDP here.
For Ashok’s team, this meant that even though only a handful of client records were technically exposed on that stolen laptop, the notification obligation was exactly as binding as it would be for a breach affecting their entire client base.
What happens inside the 72 hours
Here is roughly how Ashok’s team’s response actually played out, hour by hour:
- Hour 0: Laptop theft confirmed, credentials known to be exposed. Awareness begins
- Within the first hour: IT resets the exposed credentials and isolates any systems the laptop had access to
- Same day: Initial notification sent to the Data Protection Board, covering what is known so far, nature, extent, timing, likely impact
- Within 6 hours: Depending on what was exposed, a separate report to CERT-In may also be due. Read more on how the CERT-In and DPDP clocks work together
- Over the following hours: The investigation continues, the affected client list is refined, and the detailed report to the Board is prepared for submission within 72 hours of awareness, unless the Board allows a longer period. Affected Data Principals must be notified without delay; their notification deadline is not 72 hours
- After notification: Remediation continues, and every action is documented with timestamps, since the Board’s detailed report and any later inquiry will expect a clear record
Can you get more time?
The Board may allow a longer period for submitting the detailed report if your business requests it in writing. An extension is not automatic; it depends on the Board allowing the longer period.
What it costs to get this wrong
The penalty for failing to meet the obligation to notify the Board or affected Data Principals may extend to ₹200 crore. This is the statutory maximum, not an automatic fine for every incident. Separately, failure to take reasonable security safeguards to prevent personal data breaches may attract a penalty of up to ₹250 crore.
Why your backup and recovery setup matters here
The Board expects real detail in that report: exactly what data was affected, how many records, when the breach happened, and which systems were involved. Saying ‘some information may have been accessed’ is not enough.
Giving that level of detail within 72 hours means already knowing where your data lives and having clean, organized records of it before anything goes wrong, not scrambling to piece it together after. A backup and recovery platform with suitable audit logging can help teams investigate incidents and reconstruct events. However, accurate and timely reporting also depends on data inventories, access records, incident logs, and a tested response process.
Frequently Asked Questions
How long do businesses have to report a data breach under DPDP?
Under the DPDP Rules, once the relevant provisions commence in May 2027, a Data Fiduciary must notify the Data Protection Board without delay and submit detailed information within 72 hours of becoming aware of a personal data breach, unless the Board allows a longer period on a written request. Affected Data Principals must also be notified without delay.
Does DPDP require notifying individuals for every breach, regardless of severity?
Under Rule 7, once the relevant provisions commence in May 2027, Data Fiduciaries must notify affected Data Principals without delay following a personal data breach. The Rules do not provide a GDPR-style risk-based exception for notifying individuals.
When does the 72-hour clock actually start?
Under Rule 7, the 72-hour period for submitting detailed information to the Board starts when the Data Fiduciary becomes aware of a personal data breach. This reporting requirement is scheduled to commence in May 2027. The initial notification to the Board and notification to affected Data Principals are required without delay once the relevant provisions commence.
What is the penalty for failing to notify a data breach under DPDP?
The statutory maximum penalty for failing to notify the Board or affected Data Principals as required is ₹200 crore. This is the maximum penalty, not an automatic fine per incident.
Can a business get more time than 72 hours to report a breach?
Yes. The Data Protection Board may allow a longer period for submitting detailed information if the Data Fiduciary makes a written request. An extension is not automatic.
References
For more information, refer to the official legal documents below:
Digital Personal Data Protection Act, 2023
DPDP Act, 2023 — Commencement Notification, 13 November 2025
Digital Personal Data Protection Rules, 2025
Disclaimer: This article is intended for general informational purposes only and does not constitute legal advice. Businesses should consult qualified legal professionals to understand how the DPDP Act applies to their specific circumstances.
Follow our Twitter and Facebook feeds for new releases, updates, insightful posts and more.
