DPDP and data breaches: what to do if customer data leaks
Under the DPDP Act a breach sets two clocks running: tell the Data Protection Board and tell every affected person. Here is what the notices must say and what to prepare now.
A breach used to be an IT problem. Under the DPDP Act it is also a legal event, with people to notify. The main duties start on 13 May 2027.
Who you must tell
If personal data is exposed, stolen or leaked by accident, Section 8(6) requires you to inform:
- the Data Protection Board of India, and
- each person whose data was affected.
What the notices must contain
The Rules (Rule 7) ask for two steps to the Board: a short notification without delay, then fuller detail within 72 hours (longer only if the Board allows it). Each affected person must also be told without delay, plainly:
- what happened and what data was involved,
- what harm they might face, such as spam or fraud,
- what you have done about it, and
- what they can do to protect themselves, and who to contact.
Write for a customer, not a lawyer.
What it can cost
Failing to notify a breach carries a penalty of up to ₹200 crore. Failing to keep data reasonably secure carries up to ₹250 crore. Reasonable security includes basics such as strong passwords, access controls, encryption or masking, backups, and keeping logs for at least a year so a breach can be investigated. These are ceilings, not predictions.
What to prepare before it happens
- A named person who decides, and a backup.
- Draft notices for the Board and for customers.
- A way to freeze deletion of logs the moment you suspect an incident.
- A practice run: walk through a scenario and time each step.
Simple rule: if your data is leaked, report it to the Board and tell the people affected, in plain words and without delay.
Our own breach plan and what is still missing from it are public. Check your own readiness for free.
General information, not legal advice. Check the Act and Rules before relying on it.