DPDP Breach Notification: A Rule 7 Playbook for the 72-Hour Clock

Picture a Friday evening. A developer on your team notices that an S3 bucket holding customer KYC scans has been publicly readable for three weeks. Nobody knows who has looked at it. The next 72 hours decide whether this is an unpleasant incident or a regulatory problem.

That clock is what DPDP breach notification is about. Rule 7 of the Digital Personal Data Protection Rules, 2025 sets out who you must tell, in what order, and with what content. The duty applies in full from around 13 May 2027, but the habits that make it workable take months to build. This post walks through what the rule asks for and a plan a small team can actually run.

What DPDP breach notification requires under Rule 7

Rule 7 has two separate tracks, and mixing them up is the commonest mistake.

Track one: the affected people. Once you become aware of a personal data breach, you must tell each affected Data Principal without delay. The notice goes through their user account or a communication channel they registered with you, and it must be concise, clear and in plain language. It has five parts: what happened (nature, extent and timing), the likely consequences for that person, what you have done or are doing to reduce the risk, safety steps they can take themselves, and business contact details of someone who can answer their questions.

Track two: the Data Protection Board of India. You inform the Board without delay, with a first description covering the nature, extent, timing, location and likely impact of the breach. Then, within 72 hours of becoming aware, you send the detailed version: updated facts, the events and reasons behind the breach, mitigation measures, findings about who caused it, steps to prevent a repeat, and a report on the notices you sent to affected individuals. The Board can allow a longer period, but only if you ask in writing.

Note what the 72 hours applies to. It is the deadline for the detailed Board submission, not for telling customers, and not for the first alert. Both of those are "without delay," which is stricter in spirit than any fixed number. Several commentators describe the whole thing loosely as a "72-hour rule"; the text is more precise than that.

The penalty is separate from the breach itself

Under Section 8(6) of the Act, failing to notify the Board and affected Data Principals is its own contravention. The Schedule puts the ceiling for that at ₹200 crore. Failing to maintain reasonable security safeguards under Section 8(5) carries a ceiling of ₹250 crore. They can stack. You could have decent safeguards, still suffer a breach, and then be penalised purely for staying quiet.

These are maximums, and nobody should expect an Indian SME to receive a ₹200 crore penalty for a first slip. The Board is also yet to be fully staffed (see our note on what SMEs should do while the Board has no members). But a documented, timely response is the cheapest mitigation you will ever buy.

Build the playbook before you need it

A workable incident plan fits on two pages. Here is what ours looks like for clients with fewer than 200 staff.

1. Name the decision-maker. One person, with a deputy, who can declare "this is a personal data breach" at 11 pm. If that needs a committee, the clock runs while people argue. If you have appointed a DPO or an outsourced contact, see our data protection officer services for how that role fits.

2. Define "aware." The 72 hours runs from when you become aware. Write down what triggers awareness: a confirmed alert, a vendor email, a researcher's message. Log the exact time. Auditors will ask.

3. Keep a contact map. For every system holding personal data, record the owner, the vendor, and the vendor's incident contact. During a breach at a payment gateway or CRM provider you will be chasing them, not the other way round. Your vendor contracts should oblige them to tell you quickly. Our guide to data processing agreements covers the clauses.

4. Pre-draft the notices. Keep a fill-in-the-blanks customer email and a Board template with the five and six elements above. Writing plain-language text under stress goes badly; editing a draft goes fine.

5. Preserve evidence. Rule 6 asks fiduciaries to retain relevant logs and personal data for one year to detect and investigate unauthorised access. If your cloud logs roll over after 30 days, you cannot answer the Board's questions about causes. Check retention settings now.

6. Run one tabletop exercise. Ninety minutes, one invented scenario, everyone with a role. You will find that nobody knows who holds the customer list for the notification, or that the registered email field is empty for a third of users.

The gap most firms discover too late

Notice to Data Principals goes through a registered channel. If your records of customers are patchy, such as old phone numbers, missing emails or shared accounts, you cannot meet Track one even with perfect intentions. Cleaning contact data is dull work, and it is exactly what you should do while there is no deadline pressure. It pairs naturally with the legacy-data exercise in our piece on the one-time notice.

A realistic timeline for your team

• Now to December 2026: assign the decision-maker, check log retention, collect vendor contacts.
• January to March 2027: write the templates, fix contact data, run the tabletop.
• April 2027: rehearse again with a different scenario, brief senior management, and review your DPDP Act compliance gaps one last time before the main duties begin around 13 May 2027.

If you process large volumes of sensitive data, or use new tools such as AI features, a privacy impact assessment will show you which breach scenarios are most likely. And if you also serve EU customers, GDPR's own 72-hour regulator clock means one playbook can cover both; see GDPR compliance consulting.

This article is general guidance and not legal advice. Dates and rule text can change, so confirm against the official Gazette and take advice on your specific facts. To see where your business stands, try our DPDP checklist or talk to us.