72-hour DPDP breach playbook (Rule 7)

What Rule 7 asks for

A personal data breach is any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability (s.2). Rule 7 applies to every such breach, not only serious ones.

Hour-by-hour plan

The 72-hour report is the fixed limit. The earlier hours are working targets that help you act without delay; agree your own with counsel.

1. 01Hour 0: become aware

   Log the time you became aware, because the 72 hours run from it. Open an incident record and name an incident lead.

2. 02Hours 0 to 6: contain and triage

   Stop the exposure, preserve logs and evidence, and decide whether personal data is involved. Check whether it is also a specified cyber incident under CERT-In's 6-hour duty.

3. 03Hours 6 to 24: intimate the Board and start telling people

   Send the Board its intimation. Start intimating affected Data Principals as soon as you know who they are and what they should do; do not hold this for the full investigation.

4. 04Hours 24 to 48: finish intimations and investigate

   Complete intimations to everyone affected and log each one. Establish the cause, findings on who caused it and the remedial steps.

5. 05Hours 48 to 72: file the detailed report

   Compile the detailed report, have legal review it, and give it to the Board before the 72-hour mark. If you need more time, make a written request to the Board before the deadline.

6. 06After 72 hours: review

   Finish remediation, hold a post-incident review, update the playbook and track actions to closure.

RACI for the first 72 hours

R is responsible, A accountable, C consulted, I informed. Adapt the roles to your organisation.

What goes in the detailed report

• The facts and circumstances of the breach
• Its cause
• The mitigation measures taken
• Findings on who caused it
• Remedial steps
• A report on the intimations given to affected Data Principals

Keep a template with these headings ready, so the team fills in facts rather than formatting under pressure.

Prepare now, while the Board has no members

• A Board intimation template and a detailed-report template with the Rule 7 headings
• A plain-language notice template for Data Principals, in the languages your users read
• A named person who files with the Board, and a backup
• A watch on official notices for the Board's intimation channel
• Contact routes for every user: account inbox, registered email or mobile number
• Processor clauses requiring breach notice to you without delay (see processor contracts)

Run a tabletop exercise every six months. Walk a sample scenario, such as an exposed storage bucket at Example Lending, through the hour-by-hour plan and draft the detailed report from the template.

How TruePrivacy helps

Breach management records the incident: description, severity, affected individuals, when you became aware and the affected laws. A risk assessment runs before notifying, and clocks run per audience: the Board without delay (TruePrivacy uses a 24-hour working target), the Board's detailed report within 72 hours, and each affected Data Principal without delay.

Individual notifications are logged, and the post-incident review can create entries in the risk register. TruePrivacy does not run a CERT-In track, so keep that report in your security process. Related template: the breach report template.