Under the DPDP Act 2023 and the DPDP Rules 2025, a data fiduciary that experiences a personal data breach must notify both the affected Data Principals and the Data Protection Board of India. Notification to Data Principals must be made without delay in the manner the Rules prescribe, and the Board must be informed promptly, with follow-up detail as the investigation develops. This checker takes your breach date and type, then shows your notification obligations, who you must inform, and how urgent the clock now is.
A breach starts a clock. Enter what happened and when, and see exactly who you must notify, in what order, and how urgent it now is under the DPDP Rules 2025.
The DPDP Act 2023 imposes a duty on data fiduciaries to notify personal data breaches, and the DPDP Rules 2025 flesh out how. A fiduciary must inform the affected Data Principals without delay, telling them what happened, the likely consequences, and the measures they can take to protect themselves. Separately, the fiduciary must notify the Data Protection Board of India promptly, and then supplement that report with fuller detail — the nature and scope of the breach, its likely impact, and the remedial steps taken — as the investigation progresses.
The obligation applies broadly. A breach is not limited to a headline-grabbing hack; unauthorised access, disclosure, loss, destruction or alteration of personal data can all trigger the duty. And because the notification duty is separate from the duty to secure data in the first place, you can be penalised for a slow or absent notification even where the underlying breach was contained.
Under the DPDP Act, failing to notify a breach can attract a penalty of up to ₹200 crore, and a security-safeguard failure that led to the breach can reach ₹250 crore — so the notification is not a formality, it is a distinct, heavily weighted obligation. Regulators the world over draw a sharp line between organisations that detect, contain and notify quickly and those that hide or delay, and the DPDP framework is built to reward the former.
Niti Bharat helps Indian mid-market companies build a breach response runbook as part of its fixed-price DPDP engagements — detection, containment, Data Principal and Board notification templates, and an evidence log — so that when a breach happens, the clock is met rather than missed. Having this in place before the expected May 2027 enforcement date turns a chaotic scramble into a controlled, defensible response.
A step-by-step breach response runbook with Data Principal and Data Protection Board notification templates, a containment checklist and an evidence log.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
