Rule 7
Understanding DPDP Rule 7 breach duties
Rule 7 sets two audiences and two kinds of message. Here is the timeline, the evidence to keep, and what to do while the Board is unfilled.
Short answer
Rule 7 of the DPDP Rules, 2025 requires a Data Fiduciary that becomes aware of a personal data breach to intimate each affected Data Principal and the Data Protection Board without delay. Within 72 hours of becoming aware, or longer if the Board allows on a written request, it must give the Board a detailed report. Rule 7 comes into force on 13 May 2027.
What counts as a personal data breach
The Act defines a personal data breach as any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability (s.2). Loss of access counts, not only disclosure.
s.8(6) puts the duty to intimate the Board and each affected Data Principal on the Data Fiduciary, and you are responsible for processing by your processors (s.8). Rule 7 sets out how to intimate.
Two audiences, two kinds of message
| Audience | When | What to include |
|---|---|---|
| Each affected Data Principal | Without delay | In plain language, through their user account or registered contact: the nature, extent and timing of the breach, likely consequences, mitigation, safety steps they can take, and a contact |
| Data Protection Board: intimation | Without delay | An intimation of the breach; read the Rule 7 text with counsel for its contents |
| Data Protection Board: detailed report | Within 72 hours of becoming aware, or longer if the Board allows on a written request | Facts and circumstances, cause, mitigation, findings on who caused it, remedial steps, and a report on the intimations to Data Principals |
Rule 7 asks you to reach Data Principals through their user account or registered contact, so check those details are current before you need them. Draft the message in advance with our breach report template.
A timeline from the moment you become aware
The 72-hour period runs from when you become aware of the breach, so record that time first. The steps below can overlap.
- 01Hour 0: become aware
Record the time and who reported it. This starts the 72-hour period for the Board's detailed report.
- 02Contain and assess
Stop the exposure, identify the systems and personal data involved, and work out which Data Principals are affected.
- 03Intimate the Board
Rule 7 asks for this without delay. The detailed report follows separately.
- 04Intimate each affected Data Principal
Without delay, in plain language, through their user account or registered contact, with the details in the table above.
- 05By hour 72: detailed report
Give the Board the detailed report or, if you need longer, make a written request to the Board.
- 06After: review
Record what happened and what changed, and keep the evidence.
Evidence checklist
- The time you became aware, and how.
- Systems, kinds of personal data and Data Principals affected.
- Copies of each intimation to Data Principals, with how and when each was sent.
- The intimation and detailed report sent to the Board, with times.
- Messages with processors about the incident.
- Logs that show the access, kept for one year under Rule 6.
- Remedial steps and who approved them.
Rule 6 also expects visibility of access through logs, monitoring and review, plus backups and continuity. Those records are what you draw on to write the detailed report. See our record-keeping guide.
The Board vacancy and other reporting duties
As of 4 November 2026 no Board members have been appointed, and Rule 7 starts on 13 May 2027. Watch for the Board's process for receiving intimations and plan with counsel. Separately, CERT-In's directions of 28 April 2022 under s.70B of the IT Act require reporting specified cyber incidents to CERT-In within 6 hours. Sector regulators may have their own rules: check your regulator's directions alongside DPDP.
How TruePrivacy helps
Breach management records the incident: description, severity, affected individuals, when you became aware and the affected laws. A risk assessment comes before notifying.
It runs a clock for each audience: the Board intimation, with a 24-hour working target because the Rule says without delay; the Board's detailed report within 72 hours; and each affected Data Principal without delay. Individual notifications go from the same record, and a post-incident review can add entries to the risk register. TruePrivacy does not run a CERT-In track.
For the full runbook, see the 72-hour playbook and the breach report template.
How long do I have to report a breach under DPDP Rule 7?
Intimate the Board and each affected Data Principal without delay. Give the Board a detailed report within 72 hours of becoming aware, or longer if the Board allows on a written request.
How do I tell affected Data Principals?
In plain language, through their user account or registered contact, covering the nature, extent and timing of the breach, likely consequences, mitigation, safety steps and a contact (Rule 7). Check specific cases with counsel.
Is DPDP breach intimation the same as CERT-In reporting?
No. CERT-In's directions of 28 April 2022 require reporting specified cyber incidents to CERT-In within 6 hours. Rule 7 is a separate DPDP duty.
When does Rule 7 apply?
From 13 May 2027, when Rules 3, 5 to 16, 22 and 23 come into force (Rule 1).
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin