From detection to notification: the four phases
Phase 1: Detection (T+0 to T+2 hours)
What triggered awareness: alert from monitoring, vendor disclosure, customer complaint, journalist inquiry, regulatory contact? Each requires different early-stage handling. Containment is the immediate priority — kill the access vector, isolate affected systems, preserve evidence.
Phase 2: Triage (T+2 to T+12 hours)
Cross-functional incident response team convenes (technical, legal, comms, business owner, exec sponsor). Initial scope assessment: which data, how many records, what attack vector. Severity classification: is this notifiable? The DPDP threshold is broad — any 'personal data breach' that is 'unauthorised processing' or 'accidental disclosure' triggers Section 8(6).
Phase 3: Notification (T+12 to T+72 hours)
If notifiable, two distinct notifications must go out without delay:
- To the Data Protection Board of India: detailed report per Rule 7 — nature of breach, categories and approximate number of records, likely consequences, measures taken.
- To each affected Data Principal: clear, plain-language notice — what happened, what data, what steps they should take, who to contact for help.
'Without delay' is not 72 hours. The 72-hour figure is GDPR — DPDP doesn't specify but enforcement expectations are likely to be similar. Don't wait for full investigation; send an initial notification with what's known, and update as more is established.
Phase 4: Containment, recovery, lessons (T+72 hours onwards)
Full forensic investigation, root-cause analysis, remediation plan, regulatory follow-up, customer communications, post-incident review. The post-incident review is critical — it's the evidence of 'reasonable measures' that limits liability under Section 8(5).
The communication choreography
Pre-prepared notification templates (use Template 05) save 6+ hours during a real incident. Templates should include placeholders for incident-specific data, but the structure, tone and required elements should be locked.
Internal communications: an established escalation tree, with backups for every primary contact. War-room channel established at T+0.
The decision authorities
Document who has authority to: declare an incident, escalate to the Board, initiate notification, agree settlement of any subsequent claim, communicate publicly. These decisions cannot be made for the first time during the incident.
The runbook
Template 04 (72-Hour Breach Runbook) is our 25-page reference covering all six phases (T+0 through T+30), with role-specific checklists, severity classification, decision trees and tabletop scenarios. Read it before you need it.