s.2 · s.8 · Rule 7 · Sch.
Personal data breach
A personal data breach is any unauthorised processing of personal data, or any accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises its confidentiality, integrity or availability.
The definition is wider than a hack. A laptop lost with client files on it, an email sent to the wrong recipient, a ransomware lockout that removes access, and an employee looking at records they had no reason to open all qualify.
Section 8(6) requires the Data Fiduciary to intimate the Board and each affected Data Principal, and Rule 7 sets the clocks: notice to affected individuals and to the Board without delay, and a detailed report to the Board within seventy-two hours, extendable only by the Board. Failure carries the Rs 200 crore band in the Schedule.
Questions people ask
- Do we have to report a breach even if no harm results?
- Yes. Section 8(6) does not have a harm threshold; the Act removed the materiality test that some earlier drafts carried.
- What goes in the seventy-two hour report?
- Rule 7 lists it: the nature and extent of the breach, its likely impact, the measures taken, the person who can answer questions, and what affected principals were told.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.