Personal Data Breach
Any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability.
A personal data breach is any event that exposes, changes, destroys or locks people out of personal data without authority. It does not have to be a hack; a wrong email or a lost laptop can be enough.
Meaning of Personal Data Breach
A breach does not need a hacker. A misdirected email with a customer list, a lost unencrypted laptop, a deleted database with no backup and a ransomware lock-out can all be breaches. The Data Fiduciary must tell each affected Data Principal and the Board, and the Rules set what the notice must contain and the 72-hour detailed report.
Section 2 defines a personal data breach as any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability. Each of the three words maps to a type of harm: confidentiality is about who sees the data, integrity about whether it has been changed, and availability about whether those who need it can still reach it.
This is wider than most people expect. A ransomware attack that encrypts a hospital's records without copying them is a breach because availability is lost. An employee who emails a client list to the wrong address is a breach even though nobody attacked anyone. A developer who deletes a production database without backup causes a breach by destruction. Intent is not part of the definition.
The consequences are set by Section 8(6) and Rule 7. On becoming aware of a breach, the fiduciary must intimate the Data Protection Board and each affected Data Principal. Rule 7 asks for the Data Principal to be informed without delay in plain language, covering the nature, extent, timing and likely impact, the steps taken, protective measures she can take and a contact for questions. The Board must be informed without delay, followed by a detailed report within 72 hours or a longer period the Board allows.
There is no materiality threshold in the Act. It does not say that only breaches likely to cause harm are reportable, so even small events need assessment. Other regimes also apply side by side: CERT-In directions require reporting of specified cyber incidents within six hours, and regulators such as RBI, SEBI and IRDAI have their own incident rules for regulated entities. A breach at a processor is the fiduciary's responsibility under Section 8(1) and 8(5).
Examples of Personal Data Breach
An employee emails a spreadsheet of 2,000 customers to the wrong external address. That is an unauthorised disclosure and a possible breach.
A hospital's records server is locked by ransomware, and staff cannot open patient files for two days. No data appears to have been copied, but availability is lost, so the hospital treats it as a breach and informs patients and the Board.
A payments app finds that a misconfigured storage bucket exposed KYC images for several hours. It closes the bucket, checks access logs, sends plain-language alerts to affected users and files a detailed report within 72 hours.
An HR executive emails a salary sheet for 300 employees to a wrong external address. The company asks the recipient to delete it, records the incident, and assesses whether employees must be told because the disclosure was unauthorised.
Why Personal Data Breach matters
Breaches carry the most direct financial exposure in the Act. Failure to maintain reasonable security safeguards to prevent a breach can lead to a penalty of up to ₹250 crore, and failure to give the required intimation to the Board and affected Data Principals can lead to up to ₹200 crore. These are separate heads, so a company may face both for the same incident.
For individuals, a breach can mean fraud, identity misuse, harassment or lost access to medical or financial records. For the organisation there are also operational costs: forensic work, customer communication, lost trust and possible regulator action. A rehearsed response usually reduces all of these.
How it works in practice
- 1Detect early. Centralise logs, set alerts for unusual downloads or access, and retain logs for at least a year as Rule 6 expects, so you can establish what happened and when.
- 2Maintain an incident-response plan that names an incident lead, a legal contact, a communications owner and technical responders, with a 24-hour contact route. Test it with a drill at least once a year.
- 3Classify each incident quickly: what data, how many people, which systems, what harm is likely. Contain the problem first, then decide on notifications using the Act, the Rules and sector rules together.
- 4Prepare templates for the Data Principal message and the Board report in advance. The message should use plain language and tell people what to do, such as resetting passwords or watching for suspicious calls.
- 5Include processors in the plan. Your contracts should require them to tell you immediately of any incident and to cooperate with investigation and evidence preservation.
- 6After the event, record root cause, remedial actions and lessons learned, and track the actions to closure.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Waiting for proof of misuse before reporting. The duty arises from the breach, not from confirmed harm.
Treating only hacking as a breach. Accidental disclosure and loss of access are within the definition.
Informing the Board but not the individuals, or the reverse. Section 8(6) requires both.
Leaving processor incidents to the vendor. The fiduciary is accountable and must have contract terms that force quick notice.
Compliance tips
Keep an incident register that records every event, including near-misses, so patterns become visible.
Run a ransomware tabletop exercise with IT, legal, HR and communications every year.
Align your single playbook with Rule 7, CERT-In directions and any sector-regulator rules, so one decision tree covers all clocks.
Take offline, tested backups, because availability loss counts as a breach and recovery speed limits harm.
Common questions about Personal Data Breach
Is a lost laptop a personal data breach?
It can be, if the laptop holds personal data and that data is exposed or access to it is lost. [Encryption](term/encryption) reduces the risk, but the event still needs assessment because the definition covers loss of access and unauthorised acquisition, not only deliberate attacks.
How quickly must a breach be reported under the DPDP Rules?
Rule 7 requires the affected Data Principals and the Board to be informed without delay, with a detailed report to the Board within 72 hours or a longer period the Board allows. CERT-In directions separately require cyber incidents to be reported within six hours.
Does every breach have to be reported, even a small one?
The Act does not set a minimum size or harm threshold in Section 8(6). The safe approach is to assess every event, document the decision and report where the definition is met. Take legal advice for borderline cases.
What is the penalty for not reporting a breach?
Failure to give the Board and affected Data Principals the intimation required by the Act can attract a penalty of up to ₹200 crore under the Schedule, after an inquiry by the Board. Weak security safeguards that led to the breach can attract up to ₹250 crore separately.