Question · Breach
DPDP breach reporting: the seventy-two hour clock
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
Two clocks. On becoming aware of a personal data breach, intimate every affected Data Principal and the Board without delay. Then, within seventy-two hours of becoming aware, send the Board a detailed report. There is no harm threshold and no encryption exception; every breach as defined in Section 2 is reported. Failure sits in the Rs 200 crore band.
What counts as a breach
Section 2 defines it as any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to it, that compromises confidentiality, integrity or availability. A lost laptop, a misdirected email, a ransomware lockout and an insider reading records all qualify.
The first clock: without delay
Rule 7(1): each affected Data Principal, through their registered channel, in plain language, with what happened, the likely consequences, the measures taken, what they can do, and a contact. Rule 7(2): the Board, with a description of the breach. Both at once, with what is known.
The second clock: seventy-two hours
Rule 7(2): a detailed report to the Board within seventy-two hours of becoming aware, or a longer period only if the Board allows on written request. Contents: updated facts, causes, impact, mitigation, the person responsible if found, remedial measures, and a report on the intimations made to individuals.
Processors
Section 8(1) keeps the Fiduciary responsible for a processor’s breach, and Section 8(6) places the intimation duty on the Fiduciary. The processor contract has to oblige the processor to tell you fast enough to meet your own clock.
Questions people ask
- Does the clock start at the breach or when we find out?
- When you become aware, under Rule 7.
- Do we report a breach that affected one person?
- Yes. There is no threshold on scale or harm.
- What if we are still investigating at seventy-two hours?
- Send the report with what is known and state what is still being established. Extra time is available only if the Board grants it on a written request.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.