Under the DPDPA, a personal-data breach must be notified to the Data Protection Board and to each affected data principal. Speed and preparation decide whether you meet your obligations.
Know your clocks
Indian organisations often face stacked deadlines: CERT-In directions require reporting certain cyber incidents within 6 hours; the DPDPA requires breach intimation to the Board and affected principals. If you also fall under the GDPR, that’s a 72-hour authority clock too. Every clock starts from when you become aware.
Build the playbook before the breach
- Detect & log the “aware” time precisely.
- Contain and preserve evidence.
- Assess scope: whose data, what categories, how many.
- Notify the regulator(s) and affected principals using pre-drafted templates.
- Remediate and record lessons learned.
What to tell people
Give affected principals a clear, plain-language notice: what happened, what data was involved, what you’re doing, and what they should do.
PrivacyOS’s breach register runs CERT-In, DPDPA and GDPR clocks from your “aware” time and sends templated regulator and principal notifications in one click.