Rule 7: Intimation of Personal Data Breach

Quick summary

What Rule 7 says

• To each affected Data Principal, without delay: a description of the breach (nature, extent, timing); likely consequences to her; mitigation measures taken/ being taken; safety steps she can take herself; and contact information of someone who can respond to her queries.
• To the Board, without delay: a description of the breach including nature, extent, timing, location of occurrence and the likely impact.
• To the Board, within 72 hours of becoming aware (or a longer period the Board allows on a written request): updated and detailed information; the broad facts, circumstances and reasons leading to the breach; mitigation measures implemented or proposed; any findings on who caused the breach; remedial measures to prevent recurrence; and a report on the intimations given to affected Data Principals.

Breaking it down

Notice this rule creates two separate notification tracks running at the same time, not one notification sent to two audiences:

Track 1: affected individuals, without delay, in plain language. The individual-facing notice has to be concise, clear and plain — no legal jargon burying what happened, what it means for them, and what they can do. It goes through the user account or another registered mode of communication.

Track 2: the Board, in two stages. The Board gets an initial, faster notice (without delay) describing the breach's basic facts and likely impact, followed by a fuller, more investigative report within 72 hours — covering root cause, remedial steps, responsibility findings, and confirmation that affected individuals were actually notified. That second-stage deadline can be extended, but only on a written request to the Board, not unilaterally.

“Without delay” is deliberately not a fixed number of hours. Unlike the 72-hour Board deadline, the individual notification and the Board's first-stage notice use “without delay” rather than a specific time limit — meaning the expectation is essentially immediate action once the breach is known, not “within some reasonable-sounding window.”

Why this rule matters

A breach-response plan that doesn't map cleanly onto Rule 7's two tracks and specific content requirements will fail exactly when it matters most — in the chaotic first 72 hours after a breach is discovered, when there's no time to figure out the rules from scratch.

Real-world example

Who needs to care about this rule

• Security, legal and communications teams jointly — breach response is rarely a single team's job.
• Anyone drafting an incident-response runbook, who needs these exact timelines and content requirements built in, not improvised after the fact.

Common questions

Related rules