DPDP Breach Notification Checker

Under DPDP Act 2023 Section 8(6), Data Fiduciaries must notify the Data Protection Board of personal data breaches. The notification must be made in the prescribed form and the DPDP Rules are expected to specify 72 hours as the maximum notification period from the time the Fiduciary becomes aware of the breach.

DPDP Act 2023 requires notification to the DPB and to each affected data principal whose data has been breached. The Rules will specify the format and timeline for individual notifications. However, if notification to individuals is not required after DPB assessment, the Fiduciary may be relieved of that obligation.

Failure to notify a personal data breach to the DPB can attract a penalty of up to ₹200 crore under the DPDP Act Schedule. Timely notification combined with a voluntary remediation plan is the single most important mitigation factor in breach enforcement actions.