Rule 7
DPDP Rule 7 breach notification
Rule 7 sets two intimations after a personal data breach, one to each affected person and one to the Data Protection Board, followed by a detailed report to the Board.
Short answer
On becoming aware of a personal data breach, a Data Fiduciary must intimate each affected Data Principal without delay, in plain language, and intimate the Data Protection Board without delay (s.8(6), Rule 7). Within 72 hours of becoming aware, or longer if the Board allows on a written request, it must give the Board a detailed report. Rule 7 starts on 13 May 2027.
What counts as a personal data breach
The Act defines a personal data breach as any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability (s.2).
The definition covers more than hacking. Losing access to personal data, for example data you cannot restore, compromises availability and can be a breach too. Under s.8(6), the fiduciary must intimate the Board and each affected Data Principal; Rule 7 sets how.
Two intimations, two audiences
| Question | Each affected Data Principal | The Data Protection Board |
|---|---|---|
| When | Without delay, on becoming aware | Without delay, on becoming aware; then a detailed report within 72 hours |
| How | In plain language, through their user account or registered contact | An intimation, followed by the detailed report |
| What to include | Nature, extent and timing of the breach; likely consequences; mitigation; safety steps they can take; a contact for questions | In the detailed report: facts and circumstances, cause, mitigation, findings on who caused it, remedial steps, and a report on the intimations to Data Principals |
The two intimations run in parallel. Do not wait for one before starting the other.
What the 72-hour report must contain
Within 72 hours of becoming aware of the breach, or a longer period if the Board allows it on a written request, the fiduciary gives the Board a detailed report covering:
- the facts and circumstances of the breach;
- its cause;
- the mitigation measures taken;
- findings on who caused it;
- the remedial steps taken; and
- a report on the intimations given to affected Data Principals.
The breach report template follows this structure.
A plan for the first 72 hours
- 01Record when you became aware
The clocks run from awareness. Log the time and who raised the alarm.
- 02Contain and assess
Stop the breach, find the affected systems and data, and work out who is affected.
- 03Intimate affected people
Tell each affected Data Principal without delay, in plain language, with the Rule 7 contents.
- 04Intimate the Board
Send the Board its intimation without delay. Do not hold it back until the investigation is complete.
- 05Build the detailed report
Complete it within 72 hours of awareness, or ask the Board in writing for more time if you need it.
- 06Review and fix
Record the root cause and remedial steps, and check that processor contracts require breaches to be reported to you without delay.
The 72-hour playbook adds roles and templates.
Other duties and the current status
CERT-In's directions of 28 April 2022 under s.70B of the IT Act require reporting specified cyber incidents to CERT-In within 6 hours. That is a separate duty from Rule 7. Sector regulators may have their own rules too, so check your regulator's directions alongside DPDP.
Rule 6 asks you to keep logs for one year to detect and investigate unauthorised access. Those logs are what the detailed report draws on.
Rule 7 starts on 13 May 2027, and no Board members have been appointed yet. Build and rehearse the process now, and check with counsel how to intimate the Board once it starts work.
How TruePrivacy helps
Breach management in TruePrivacy records the incident: description, severity, affected individuals, when you became aware and the laws affected. A risk assessment comes before notifying, and notification clocks run per audience.
For the Board's “without delay” intimation, TruePrivacy uses a 24-hour working target, alongside the 72-hour clock for the detailed report and the “without delay” clock for each affected Data Principal. Individual notifications go out from the same record, and a post-incident review can add actions to the risk register. TruePrivacy does not run a CERT-In reporting track.
Is there a 72-hour deadline under the DPDP Rules?
Yes. Within 72 hours of becoming aware of a breach, a Data Fiduciary must give the Board a detailed report, unless the Board allows longer on a written request (Rule 7). The first intimation to the Board is due without delay.
Do we have to tell every affected person?
Yes. Rule 7 requires intimating each affected Data Principal without delay, in plain language, through their user account or registered contact.
Can the 72 hours be extended?
Yes, if the Board allows a longer period on a written request.
Is DPDP breach reporting the same as CERT-In reporting?
No. CERT-In's directions of 28 April 2022 require reporting specified cyber incidents within 6 hours. Rule 7 is a separate duty under the DPDP Act.
What if the breach happens at our vendor?
The fiduciary remains responsible for processing done on its behalf by a Data Processor (s.8(1)), so contracts should require processors to report breaches to you without delay.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin