Rule 7
DPDP Rule 7 breach notification workflow
After a personal data breach, two audiences need to hear from you without delay, and the Board needs a detailed report within 72 hours. TruePrivacy puts each on its own clock.
Sample workspace
Incident INC-207
- Without delayBoard intimationHour 14 of 24-hour target
- Rule 7Detailed report to BoardHour 14 of 72
- Without delayAffected Data PrincipalsNotified at hour 9
Audit trail
- Became aware at 09:10
- Risk assessment completed
- Detailed report due within 72 hours
Short answer
Under s.8(6) and Rule 7, on becoming aware of a personal data breach you intimate each affected Data Principal and the Data Protection Board without delay. Within 72 hours of becoming aware, you give the Board a detailed report, or within a longer period if the Board allows it on a written request. TruePrivacy records the incident, runs a risk assessment and tracks a separate clock for each notice.
What breach management does
Description, severity, affected individuals, when you became aware and the laws affected, in one record.
Assess the risk before any notice goes out, and keep the assessment with the incident.
The Board 'without delay' (TruePrivacy uses a 24-hour working target), the Board's detailed report within 72 hours, and each affected Data Principal without delay.
Notify affected Data Principals individually from the incident.
Review what happened. Actions from the review can create entries in the risk register.
How an incident runs against the clocks
Rule 7 sets two speeds: without delay for the first intimations, and 72 hours for the Board's detailed report. The breach playbook guide covers preparing for both.
- 01Record the incident
Log what happened and when you became aware. The Rule 7 clocks run from that moment.
- 02Assess the risk
Work out the nature, extent and likely consequences. The same facts feed the notices.
- 03Intimate without delay
Tell each affected Data Principal in plain language, through their user account or registered contact, and intimate the Board. TruePrivacy tracks a 24-hour working target for the Board intimation.
- 04File the detailed report
Within 72 hours, give the Board the facts, cause, mitigation, findings on who caused it, remedial steps and a report on the intimations to Data Principals. Start from the breach report template.
- 05Review and learn
Close with a post-incident review and carry actions into the risk register.
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| Intimate each affected Data Principal without delay, in plain language | s.8(6), Rule 7 | A Data Principal clock and individual notifications from the incident |
| Intimate the Board without delay | s.8(6), Rule 7 | A Board clock with a 24-hour working target |
| Detailed report to the Board within 72 hours of becoming aware | Rule 7 | A 72-hour clock from when you became aware |
| Reasonable security safeguards to prevent a breach | s.8(5), Rule 6 | Post-incident review with actions into the risk register; see data security posture |
| Security terms in contracts with Data Processors | Rule 6 | A vendor question template asking processors to report breaches without delay |
What the clocks do not cover
No Board members have been appointed yet, so prepare your playbook and evidence now and confirm how to reach the Board once members are appointed. The 24-hour figure is TruePrivacy's working target for 'without delay', not a legal deadline.
CERT-In's directions of 28 April 2022 separately require reporting specified cyber incidents to CERT-In within 6 hours. TruePrivacy does not run a CERT-In track. Check your sector regulator's directions alongside DPDP.
Works with
Question templates that ask processors to report breaches without delay.
Data security postureIssues, identities and remediation across devices, cloud stores and databases.
Data classificationKnow which kinds of personal data a breached store held.
Records of processingProcessing activities that show what a system was used for.
Is the 72-hour limit for the first notice?
No. Rule 7 asks you to intimate the Board and each affected Data Principal without delay. The 72 hours is for the detailed report to the Board, and the Board can allow longer on a written request.
What must I tell affected Data Principals?
Rule 7 asks for the nature, extent and timing of the breach, likely consequences, the mitigation you have taken, safety steps they can take and a contact, in plain language through their user account or registered contact.
Does DPDP replace CERT-In reporting?
No. CERT-In's directions of 28 April 2022 separately require reporting specified cyber incidents within 6 hours. TruePrivacy tracks the DPDP Rule 7 clocks only.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin