DPDP Breach Notification Timeline — 72-Hour Reporting Requirements

The 72-hour DPDP breach notification requirement

Section 8(6) of the Digital Personal Data Protection Act 2023 requires every Data Fiduciary to notify the Data Protection Board of India (DPBI) of any personal data breach "in such manner and within such period as may be prescribed" — and the draft DPDP Rules 2025 prescribe that period as 72 hours from the time the organisation becomes aware of the breach.

The stakes are significant. The DPDP Act's penalty framework provides for financial penalties of up to ₹200 crore for a Data Fiduciary that fails to comply with the Board's directives arising from a breach — and failure to notify at all can compound regulatory exposure substantially. The Board has discretion to impose penalties that reflect the nature and duration of the non-compliance.

A critical nuance that organisations frequently underestimate: the clock starts from becoming aware, not from conducting a full investigation or confirming the breach's scope. If your security team identifies anomalous data exfiltration on a Monday at 09:00 IST, the 72-hour clock runs to Thursday at 09:00 IST — regardless of whether your forensic investigation is complete.

The DPDP Act also creates a dual notification obligation. In addition to notifying the Board, Data Fiduciaries must notify affected Data Principals if the breach is likely to cause harm to them — for example, where sensitive personal data (health records, biometrics, Aadhaar details, financial information) is involved. This two-track notification requirement demands advance planning: most organisations cannot draft, approve, and dispatch individualised Data Principal notifications in 72 hours without pre-built templates and a clear internal escalation chain.

Significant Data Fiduciaries (SDFs) — those designated by the Central Government on the basis of data volume, sensitivity, or risk to national security — face additional obligations including mandatory Data Protection Impact Assessments and board-level reporting requirements. If your organisation may qualify as an SDF, early legal advice on your designation status is warranted.

What the DPB looks for in breach notifications

Based on comparable regulatory frameworks globally and the Board's stated objectives under the DPDP Act, a well-prepared breach notification should address the following:

• Speed: Notifications submitted within the 72-hour window demonstrate good faith. Submissions accompanied by a credible explanation when the full picture is not yet available are generally treated more favourably than late submissions that waited for a complete investigation.
• Completeness: The notification should describe the nature of the breach, the categories and approximate volume of personal data affected, the likely consequences, and the remedial measures taken or proposed. The Board is not looking for perfection — it is looking for a systematic, documented response.
• Systematic response programme: Organisations that can demonstrate they had a documented incident response plan in place — even if the breach still occurred — are significantly better positioned than those that improvised their response. The existence of an IR policy, a designated DPO or breach response team, and pre-approved notification templates all evidence a culture of compliance.
• Documented containment actions: The notification must include the steps already taken to contain the breach — revoking access, patching vulnerabilities, isolating affected systems, or notifying affected third-party processors. The Board will want to see that containment was prioritised alongside notification, not treated as secondary.
• Data Principal communication plan: Where notification to individuals is required, the Board will review whether the communications are accurate, written in plain language, and include actionable steps individuals can take to protect themselves.

Organisations that invest in breach response readiness before an incident occurs are substantially better positioned to meet these expectations under time pressure. Our Breach Response Readiness assessment evaluates your current capabilities against the DPDP Act's requirements and provides a gap-remediation roadmap.

This tool provides general guidance based on the DPDP Act 2023 and draft DPDP Rules 2025. It does not constitute legal advice. The 72-hour timeline is based on draft Rules; consult a qualified practitioner for your specific situation.