Under the DPDP Act 2023 and DPDP Rules 2025, a Data Fiduciary must notify the Data Protection Board of India and every affected Data Principal of a personal data breach — there is no 'risk threshold' that lets you stay silent. If digital personal data has been compromised, lost, or accessed without authorisation, notification is required. This tool walks you through the decision and the immediate steps.
Answer three questions to find out whether you must notify the Data Protection Board and affected individuals.
Unlike some regimes that only require notification for high-risk breaches, the DPDP Rules 2025 require a Data Fiduciary to inform both the Data Protection Board and every affected Data Principal of a personal data breach. The intimation is expected promptly, followed by a fuller report with the nature of the breach, its likely impact and the remedial measures taken.
Because the bar is low and the clock is short, the organisations that cope best are those that rehearse. A breach register, a notification template and a tested response plan turn a crisis into a procedure.
A breach decision flowchart, a Data Protection Board notification template, and a ready-to-fill breach register.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
