Rule 7
Intimation of personal data breach
Sets two clocks after a breach: immediate notice to affected principals and to the Board, then a detailed report to the Board within seventy-two hours.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- (1)
- On becoming aware of a breach, the Data Fiduciary must without delay intimate each affected Data Principal, through her user account or her registered mode of communication, in concise, clear and plain language: a description of the breach including its nature, extent and timing; the likely consequences relevant to her; the mitigation measures implemented or being implemented; the safety measures she may take to protect her own interests; and the business contact information of a person able to respond on the Data Fiduciary’s behalf.
- (2)(a)
- The Data Fiduciary must without delay give the Board a description of the breach, covering its nature, extent, timing, location and likely impact.
- (2)(b)
- Within seventy-two hours of becoming aware, or a longer period the Board allows on written request, it must give the Board updated and detailed information: the broad facts including the events, circumstances and reasons leading to the breach; the mitigation measures implemented or proposed; its findings about the person who caused the breach; the remedial measures taken to prevent recurrence; and a report on the intimations given to affected Data Principals.
In practice
Both clocks start from becoming aware, not from confirming. That is the harder engineering problem for a chain of vendors, because awareness can sit with a processor days before it reaches the fiduciary who owes the notice. Note too that the first Board notice is due without delay and the detailed report at seventy-two hours; these are two separate filings, and a single report at hour seventy-one misses the first one.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Rule 7 is not in force yet. If that date moves, or the Board says anything about how it will be read, you will get one email about it and nothing else.