Breach Intimation
The duty to tell each affected Data Principal and the Data Protection Board about a personal data breach.
Breach intimation means promptly telling the people whose data was affected, and the Data Protection Board, when a personal data breach happens, in the form and within the time the Rules set.
Meaning of Breach Intimation
Rule 7 requires prompt intimation to each affected person in a concise and plain way, covering what happened, its likely consequences, the steps taken, and what the person can do. The Board must be informed without delay, with a detailed report within 72 hours or any longer time the Board allows. Failing to notify can bring a penalty of up to ₹200 crore.
Breach intimation is the notification duty that follows a personal data breach. Section 2(u) defines a breach broadly: any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability. Section 8(6) then requires the Data Fiduciary to give the Board and each affected Data Principal intimation of the breach in the prescribed form and manner. A hack, a stolen laptop, a misdirected email and an encrypted database all can qualify.
Rule 7 sets two tracks. To each affected Data Principal, without delay, the fiduciary must send a concise, clear and plain description of the breach: its nature, extent and timing, the likely consequences for that person, the mitigation steps taken, safety steps the person can take, and a contact who can answer queries. To the Board, it must send a description without delay (nature, extent, timing, location and likely impact), then updated and detailed information within 72 hours, or a longer period if the Board allows on written request.
The 72-hour report is meatier. It covers the broad facts and reasons behind the breach, mitigation measures, findings on who caused it, remedial steps to prevent recurrence, and a report on the intimations given to affected individuals. The Rules do not carve out "small" breaches, and the Act has no harm threshold of the kind some other laws use, so a fiduciary should assume that a confirmed breach affecting personal data is reportable and decide any exception only with legal advice.
Two relationships need care. First, a Data Processor that suffers the breach should tell you quickly by contract, but the duty to notify stays with the Data Fiduciary under Section 8(1). Second, other regimes run in parallel: CERT-In directions require reporting of certain cyber incidents within six hours, and sector regulators such as RBI, IRDAI and SEBI have their own rules. Meeting one deadline does not satisfy the others, so plan for them together.
Examples of Breach Intimation
After a hacker copies a customer list, the company emails every affected customer and files its report with the Board.
A retailer finds that a misconfigured storage bucket exposed order histories for two weeks. Within hours it emails affected customers with plain advice on what to watch for, files its first intimation with the Board, and prepares the 72-hour report on root cause and fixes.
A hospital employee uploads a spreadsheet of patient names and diagnoses to a public file-sharing site by mistake. The hospital tells each patient, in a phone call followed by a letter, what was exposed and who to contact, and informs the Board with details of the site's removal.
A school's vendor-run attendance app is hacked and parents' contact details leak. The school does not wait for the vendor's report. It informs parents the same day through its messaging app and sends the Board an initial description while the vendor investigation continues.
Why Breach Intimation matters
Failure to give the intimation is one of the most expensive mistakes in the Schedule: up to ₹200 crore. A related failure to protect the data in the first place can bring up to ₹250 crore. The Board also looks at how quickly and completely you responded, so a late or vague notice can turn a manageable event into an inquiry about your wider compliance.
For individuals, speed is protection. A person told within hours that her phone number and address leaked can change passwords, watch for fraud calls and block cards. A person told months later, or never, carries the harm silently. Organisations that notify early and clearly usually keep more customer trust than those caught hiding an incident.
How it works in practice
- 1Detect and record the moment of awareness. Start a timestamped log as soon as someone with authority suspects a breach, since the 72-hour period is counted from awareness.
- 2Triage quickly. Establish what data, whose data, how many people, which systems and what harm could follow, and contain the problem. Preserve logs for the investigation; Rule 6 expects logs to be retained for at least a year.
- 3Notify individuals using the channel they already use with you, such as in-app message, email or SMS. Keep the wording short, plain and free of legal jargon, and include the five items Rule 7 lists. Offer a helpline or email for questions.
- 4File the first intimation with the Board through its prescribed digital channel, with whatever facts you have. Do not wait for a full investigation before sending it.
- 5Prepare the 72-hour report from your incident file: causes, mitigation, who was responsible, remedies and proof of individual notices. If more time is truly needed, ask the Board in writing, before the deadline.
- 6Run parallel notifications to CERT-In and any sector regulator, then record every notice and decision in the breach register.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Waiting for the forensic report before telling anyone. Rule 7 asks for notice without delay, then a detailed update later, so send what you know and supplement it.
Sending a notice that says only "a security incident occurred". The individual notice must say what was affected, likely consequences, steps taken and what the person can do.
Assuming the processor's notice discharges your duty. The Data Fiduciary remains responsible, so verify that individuals and the Board have actually been informed.
Compliance tips
Pre-draft notice templates for individuals and the Board and keep them with your incident plan, so the first hour is spent on facts and not on wording.
Ask processors to alert you within a fixed short window, such as 24 hours, and to share logs and findings, then test that route in a drill.
Keep contact data current and know which channel reaches each customer segment, including those with no email or app.
Common questions about Breach Intimation
Who must be told about a personal data breach under the DPDP Act?
Section 8(6) requires intimation to the Data Protection Board and to each affected Data Principal. Rule 7 says what to include and the timing. Sector regulators or CERT-In may also need a separate report, depending on who you are and the incident type.
What is the 72-hour rule in breach intimation?
Rule 7 asks for a detailed report to the Board within 72 hours of becoming aware of the breach, or a longer period the Board permits on written request. An initial description to the Board, and notice to individuals, is due without delay before that.
Do all breaches have to be reported, even small ones?
The Act does not set a size or harm threshold for intimation. A confirmed personal data breach should be treated as reportable, and any decision that a particular incident is not should be reasoned, recorded and made with legal advice.