Data Breach Notification Under the DPDP Act: Your 72-Hour Response Plan

Introduction: The Critical 72-Hour Window

Data breach notification under the DPDP Act is governed by one of the world’s most stringent timelines: 72 hours. In the digital age, data breaches are not a matter of if but when. The Digital Personal Data Protection Act (DPDPA), 2023, recognizes this reality — and unlike GDPR’s flexible approach or CCPA’s 30-day grace period, India’s framework demands immediate action.

This guide is for CISOs, compliance officers, legal teams, and incident responders who need a working data breach response plan. It provides a comprehensive roadmap for organizations to respond effectively within the critical 72-hour window: a phase-by-phase incident response process, a breach severity matrix, a ready-to-use Data Protection Board notification template, a post-breach audit checklist, and lessons from a real-world Indian breach.

Key Fact: DPDPA Section 6 requires notification to the Data Protection Board within 72 hours of becoming aware of a data breach. Organizations that fail to comply face penalties up to Rs. 2 crore. (For the full picture of financial exposure, see our guide to data breach penalties under the DPDP Act.)

What Counts as a Data Breach Under the DPDP Act?

Section 2(f) of DPDPA defines a data breach as “unauthorized disclosure of personal data that compromises the confidentiality, integrity, or availability of the information.” This broad definition encompasses not just cyberattacks but also accidental disclosures, insider threats, and physical security failures.

What Constitutes a Reportable Breach?

• Unauthorized Access: Hacking, credential compromise, or system infiltration
• Unauthorized Disclosure: Accidentally exposing data through misconfigured databases or misdirected emails
• Data Modification: Unauthorized alteration of personal data affecting accuracy
• Data Deletion: Ransomware attacks or malicious data destruction
• Business Email Compromise: Phishing attacks leading to credential theft
• Insider Threats: Employees or contractors accessing data without authorization

Important: Not all security incidents constitute breaches under DPDPA. Only those involving personal data of data principals require notification. However, when in doubt, it’s better to report and investigate than to face subsequent penalties for concealment.

The 72-Hour Incident Response Flowchart

The DPDPA mandates a structured timeline for 72 hour breach notification in India, with specific actions at each stage:

Step-by-Step Incident Response Process Under DPDPA

Phase 1: Detection and Verification (0-2 Hours)

Objective: Confirm the breach and prevent further data exposure.

Actions:

• Isolate affected systems immediately
• Disable compromised user accounts
• Verify the breach through multiple sources (logs, alerts, third-party reports)
• Activate the incident response team
• Document all observations with timestamps

Tools and Technologies:

• SIEM (Security Information and Event Management) systems
• Network segmentation and firewall rules
• Two-factor authentication disabling mechanisms
• Event logging and monitoring platforms

Phase 2: Assessment and Scoping (2-6 Hours)

Objective: Understand the full extent of the breach.

Actions:

• Access logs to determine when the breach began
• Identify all affected data types (PII, financial data, health records)
• Count affected data principals
• Determine breach severity category (see Severity Matrix below)
• Preserve digital evidence for forensic investigation

Critical Information to Gather:

• Date and time of breach discovery
• Date and time of breach occurrence (if different)
• Number of data principals affected
• Types of data compromised
• Whether data was encrypted or protected
• Potential threat actor (external/internal)

Phase 3: Containment (6-24 Hours)

Objective: Stop ongoing data exposure.

Actions:

• Patch vulnerabilities that enabled the breach
• Revoke compromised credentials
• Deploy security controls to prevent recurrence
• Monitor for lateral movement or data exfiltration
• Engage external incident response firm if needed

Phase 4: Data Protection Board Notification Preparation (24-72 Hours)

Objective: Prepare a comprehensive Data Protection Board notification.

The notification must include:

• Detailed description of the breach
• Date and time of discovery
• Scope (number of affected data principals, data types)
• Actions taken for containment
• Assessment of potential harm
• Measures to be taken for remediation
• Contact information for further inquiry

Data Breach Severity Classification Matrix

Data Protection Board Notification Template

Template: Formal DPB Breach Notification

To: Data Protection Board of India

Subject: Data Breach Notification Under Section 6, DPDPA, 2023

Date of Notification: [Date]

1. Organization Details:

Name: [Organization Name] Registration Number: [DPB Registration Number] Address: [Registered Address] Contact Person: [Designated DPO or Compliance Officer] Email: [Contact Email] Phone: [Contact Phone]

2. Breach Details:

Date of Breach Discovery: [Date] Date of Breach Occurrence: [Date, if different] Time of Discovery: [Time] Method of Discovery: [Self-discovery/Third-party report/Law enforcement]

3. Scope of Breach:

Number of Affected Data Principals: [Number] Types of Personal Data Compromised: [List specific data types] Method of Breach: [Hacking/Insider threat/Accidental disclosure/Physical theft/etc.] Was Data Encrypted: [Yes/No] Was Data Pseudonymized: [Yes/No]

4. Impact Assessment:

Potential Harm to Data Principals: [Describe potential consequences] Risk of Identity Theft: [Low/Medium/High] Risk of Financial Loss: [Low/Medium/High] Risk of Discrimination: [Low/Medium/High]

5. Containment Measures:

[Describe immediate actions taken to stop the breach]

6. Remediation Plan:

[Describe long-term measures to prevent recurrence]

7. Notification to Data Principals:

Date of Notification to Principals: [Date] Method of Notification: [Email/SMS/In-person/etc.] Information Provided: [Summary of provided information]

Post-Breach Audit Checklist

After initial notification, complete a comprehensive audit:

Case Study: Air India Data Breach (2021) — Lessons for DPDPA Compliance

Incident Overview: In October 2021, Air India suffered a data breach affecting approximately 4.5 million customers. Personal information including names, email addresses, phone numbers, passport numbers, and frequent flyer PII were compromised through a vulnerable web application.

What Went Wrong:

• Delayed Detection: The breach occurred in February 2021 but wasn’t discovered until August 2021 — a 6-month gap
• No Immediate Containment: The vulnerable application remained accessible for months
• Inadequate Security Measures: Lack of proper authentication mechanisms on critical systems
• Poor Incident Response: No structured procedure for breach response and notification

Lessons for DPDPA Compliance:

• Continuous Monitoring: Deploy 24/7 security monitoring to detect breaches within hours, not months
• Vulnerability Management: Regular penetration testing and vulnerability scanning should have identified the weakness
• Incident Response Team: A dedicated team should have been activated immediately upon detection
• Documentation: Every step must be documented for DPB notification and regulatory compliance
• Third-Party Accountability: For Air India, cloud service providers also bear responsibility for security

DPDPA Impact: Under the new law, Air India would face:

• Mandatory DPB notification within 72 hours
• Penalties up to Rs. 2 crore for delayed notification
• Additional penalties for inadequate security measures
• Potential suspension of data processing operations
• Mandatory credit monitoring services for affected principals

Critical Don’ts During Breach Response

What NOT to Do During a Breach:

• Don’t Delay Notification: Every hour matters. The 72-hour window is strict and non-negotiable.
• Don’t Attempt Cover-Up: Concealment violates DPDPA and attracts higher penalties than the breach itself.
• Don’t Communicate Inconsistently: Ensure all notifications to DPB and data principals contain consistent information.
• Don’t Destroy Evidence: Preserve all logs, communications, and forensic data for investigation.
• Don’t Make Premature Promises: Don’t guarantee breaches won’t happen again; instead, outline concrete improvements.
• Don’t Ignore Affected Individuals: Provide them with actionable steps to protect themselves. (Affected individuals may also have avenues of their own — see our guide on compensation for data breach victims under the DPDP Act.)
• Don’t Rely Solely on External Vendors: While third-party incident response is valuable, ultimate responsibility rests with the organization.

Philosophy: Trust and Transparency in Data Handling

The Fiduciary Principle Behind DPDPA:

DPDPA’s 72-hour notification requirement reflects a fundamental philosophical shift from India’s previous data protection framework. Rather than treating data protection as a technical compliance checkbox, DPDPA explicitly embraces the fiduciary relationship between data fiduciaries (organizations) and data principals (individuals).

A fiduciary owes a duty of care, loyalty, and transparency. This means:

• Transparency First: When a breach occurs, immediate disclosure is not punishment but an affirmation of trust. Organizations that hide breaches violate the fundamental trust placed in them.
• Accountability Matters: The 72-hour window isn’t arbitrary; it reflects the belief that accountability must be swift and visible.
• Individual Empowerment: By notifying data principals quickly, they gain agency to protect themselves (change passwords, monitor credit, etc.)
• System Integrity: Swift, transparent breach reporting strengthens the entire data protection ecosystem by creating incentives for better security.

This approach contrasts sharply with earlier “whisper campaigns” where organizations would downplay or hide breaches. DPDPA establishes that breach transparency is the foundation of trust, not its violation.

Regulatory References and Guidance

• DPDPA, 2023: Section 6 (notification of personal data breach), Section 2(f) (definition of breach)
• Data Protection Rules, 2025: Rules governing breach notification procedures and documentation
• Data Protection Board Guidance: Recent circulars on acceptable notification formats and timelines
• International References: GDPR Article 33 for comparative framework, NIST Cybersecurity Framework for incident response procedures

Frequently Asked Questions

What is the time limit for data breach notification under the DPDP Act?

72 hours. DPDPA Section 6 requires organizations to notify the Data Protection Board of India within 72 hours of becoming aware of a data breach — a stricter timeline than GDPR’s flexible approach or CCPA’s 30-day grace period.

What is the penalty for delayed breach notification under the DPDP Act?

Organizations that fail to notify the Data Protection Board within 72 hours face penalties up to Rs. 2 crore. Concealment attracts higher penalties than the breach itself, and inadequate security measures can trigger additional penalties and even potential suspension of data processing operations.

What counts as a data breach under the DPDP Act?

Section 2(f) of DPDPA defines a data breach as unauthorized disclosure of personal data that compromises the confidentiality, integrity, or availability of the information. This covers hacking and credential compromise, accidental disclosures (like misconfigured databases), unauthorized data modification or deletion, business email compromise, and insider threats.

Do all security incidents have to be reported to the Data Protection Board?

No. Only incidents involving personal data of data principals require notification under DPDPA. However, when in doubt, it’s better to report and investigate than to face subsequent penalties for concealment.

What must a Data Protection Board notification include?

The notification must include a detailed description of the breach, date and time of discovery, scope (number of affected data principals and data types), containment actions taken, an assessment of potential harm, remediation measures, and contact information for further inquiry.

How should a company prepare a data breach response plan for the DPDP Act?

Follow a phased plan: detection and verification (0-2 hours), assessment and scoping (2-6 hours), containment (6-24 hours), and DPB notification preparation and submission (24-72 hours), followed by data principal notification and forensic investigation. Building this into your broader DPDP Act compliance checklist — with a dedicated incident response team and documented procedures — is the key to meeting the deadline.

Conclusion: Preparation is Prevention

Data breaches are inevitable in the digital world. However, with proper preparation and a documented incident response plan, organizations can navigate the critical 72-hour window effectively. The key is not to avoid breaches entirely, but to respond swiftly, transparently, and in full compliance with DPDPA requirements.

Organizations that invest in breach response planning today will find themselves better equipped to protect their data principals and maintain regulatory compliance when incidents occur.

Key Takeaways

• DPDPA Section 6 requires data breach notification to the Data Protection Board within 72 hours of becoming aware of a breach, with penalties up to Rs. 2 crore for non-compliance.
• Section 2(f) defines breaches broadly — cyberattacks, accidental disclosures, insider threats, and physical security failures all qualify if personal data is compromised.
• A phased response plan (detect 0-2h, assess 2-6h, contain 6-24h, notify DPB 24-72h) with clear owners and documentation is essential to meeting the deadline.
• Severity classification drives urgency: critical breaches involving sensitive data of over 50,000 principals warrant notification within 24 hours.
• Concealing a breach attracts higher penalties than the breach itself; transparency is treated as the foundation of the fiduciary relationship with data principals.
• The Air India breach — a 6-month detection gap with no structured response — shows exactly the failures the DPDPA’s 72-hour regime is designed to prevent.