Explainer · Data Protection · Last verified October 2026
Data Breach Obligations Under the DPDP Act (2026)
A data breach is no longer only an IT problem. Under the Digital Personal Data Protection Act, 2023 (DPDP Act), the moment personal data you hold is exposed, lost or accessed without authority, the law places two duties on you at once: tell the regulator, and tell the people affected. This explainer sets out what counts as a breach, exactly who you must inform and what the notice must contain, how the Digital Personal Data Protection Rules, 2025 shape the timeline, and the penalties for getting it wrong. It is written in plain English for Indian businesses and compliance teams, and is general information, not legal advice. Last verified October 2026.
- The duty: Section 8(6) of the DPDP Act, 2023 requires a Data Fiduciary to report a personal data breach to the Data Protection Board and to each affected person.
- Two recipients, not one: the regulator and the individuals must both be told; telling only one does not satisfy the Act.
- The Rules set the timing: the DPDP Rules, 2025 (notified 13 November 2025, Rule 7) require a prompt initial intimation and a fuller follow-up report.
- No small-breach exemption: the Act's definition carries no materiality threshold, so a cautious process treats every incident as reportable until assessed.
- Penalties are large: up to Rs 250 crore for failing to take reasonable security safeguards, with a separate penalty for failing to notify a breach.
01The short answer
If personal data you control is breached, the DPDP Act requires you to give intimation to two parties: the Data Protection Board of India, and each affected data principal, which means each person whose data was involved. This duty sits in Section 8(6) of the Act and applies to the Data Fiduciary, the business that decides why and how the data is processed.
The Act sets the duty; the Digital Personal Data Protection Rules, 2025, notified on 13 November 2025, set the form, manner and timing. The practical rule of thumb is simple: do not wait to finish your investigation before you report. The law expects prompt intimation, followed by a fuller account once you know more.
02What counts as a personal data breach
The Act defines a personal data breach broadly. It is any unauthorised processing of personal data, or any accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability. In plain terms, three kinds of failure are all breaches:
- Confidentiality: someone who should not see the data gets to see it, for example a hack, a misdirected email, or a leaked database.
- Integrity: the data is changed or corrupted without authority.
- Availability: you lose access to the data, for example through ransomware or accidental deletion.
Note what the definition does not include: a materiality threshold. On the face of the Act, there is no carve-out for a breach that is "too small to matter". That is why many Indian businesses are building a process that treats every suspected incident as reportable until assessed, rather than guessing at the line.
03The two people you must tell
Section 8(6) names two recipients, and both must be told. They are not alternatives.
| Who | Why they are told |
|---|---|
| The Data Protection Board of India | The regulator supervises compliance and can investigate and impose penalties. It needs to know the nature and scale of the breach. |
| Each affected data principal | The people whose data was exposed need to know so they can protect themselves, for example by changing passwords or watching for fraud. |
This two-way duty is one of the most important features of the Indian regime. Telling the regulator but not the individuals, or the individuals but not the regulator, does not satisfy the Act. The intimation to individuals is meant to reach them through their registered means of contact, so they can act for themselves.
04What the notice must say and when
The content and timing of the notice come from Rule 7 of the DPDP Rules, 2025. The structure the Rules set out is a two-stage intimation:
- An initial intimation, without delay, describing the breach: its nature and extent, when and where it happened so far as known, and the likely impact.
- A fuller report to the Board, within a short follow-up window, setting out what happened, the measures taken to contain and remedy it, steps to prevent a recurrence, and confirmation that affected people have been informed.
The notice to each affected person should, in plain language, describe the breach, its likely consequences for them, the measures you are taking, and what they can do to protect themselves, along with a contact point for questions. Because the Rules were notified in November 2025 and come into force in stages, confirm the exact deadline that applies on your facts before you rely on a specific number of hours.
The safest working assumption under the DPDP Act is to report promptly and update later, not to wait until the investigation is complete.
05The safeguards that come before a breach
The breach duty does not stand alone. The Act separately requires a Data Fiduciary to take reasonable security safeguards to prevent a personal data breach in the first place. The 2025 Rules give this shape, pointing to measures such as encryption or masking, access controls, logging and monitoring, backups, and contractual security obligations on any data processor you use.
This matters for breach response because the Board will look at both halves together: did you have reasonable safeguards, and did you report the breach properly when one happened. A business that can show a documented security programme and a clean, prompt notification is in a very different position from one that cannot. Good record-keeping is itself part of compliance.
06Penalties for getting it wrong
The DPDP Act backs these duties with financial penalties set out in its Schedule, imposed by the Data Protection Board after an inquiry. The headline figures are large by Indian standards:
- Up to Rs 250 crore for failing to take reasonable security safeguards to prevent a breach.
- A separate penalty for failing to give the required intimation of a breach to the Board and affected people.
These are maximums, and the Board fixes the actual amount by weighing the nature, gravity and duration of the default, the type of data involved, whether it was repeated, and what the Data Fiduciary did to mitigate. An appeal from the Board lies to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). The point for a business is that both prevention and prompt reporting carry their own exposure, so neither can be neglected.
07A first-hour checklist
When a breach is suspected, the first hour matters. A practical sequence most Indian compliance teams are adopting looks like this:
- Contain first. Stop the ongoing exposure: isolate the system, revoke access, reset credentials.
- Record the clock. Note when you became aware, because the reporting windows run from awareness.
- Assess scope. What data, whose data, how many people, what harm is likely.
- Prepare the intimations. Draft the Board notice and the notice to affected people in parallel, using the content the Rules require.
- Report without waiting for certainty. Send the initial intimation promptly and update it as facts firm up.
- Document everything. Keep a timeline, decisions and copies of every notice, because you may have to show them to the Board.
For the wider consent and notice duties that sit alongside breach reporting, see consent requirements under the DPDP Act.
08Where Claw fits
Claw is an all-in-one legaltech platform for Indian advocates, law firms, and corporate legal teams, combining AI-based case search, an AI legal assistant (Legal GPT), case management, and compliance automation across all Indian courts and tribunals.
Breach response is a compliance and security task, and Claw does not run that process for you. Where Claw helps is on the legal side that follows. If a breach leads to a Data Protection Board inquiry, a penalty order, or an appeal to the TDSAT, Claw tracks the resulting proceedings and related matters across 9,102 courts, tribunals and forums, with alerts and monitoring so a hearing date or order does not slip past an in-house team. Its Legal GPT researches across 30 crore+ judgments and orders, with Supreme Court decisions from 1950 and High Court decisions from 1990, so you can see how courts have treated data, privacy and related questions. Results return in under 5 seconds, and Claw does not train its AI models on your documents. To check whether a vendor or counterparty already has litigation on record before you share data with them, run a case search across Indian courts by party name. The DPDP Rules, 2025 are being brought into force in stages, so confirm the current position for your facts; none of this is legal advice.
09Sources and further reading
- Ministry of Electronics and Information Technology (DPDP Act and Rules): meity.gov.in
- India Code (Digital Personal Data Protection Act, 2023): indiacode.nic.in
- DPDP Act reference (text of the Act and Schedule): dpdpa.com
- Claw: clawlaw.in
This explainer is general information, not legal advice. The DPDP Rules, 2025 are being commenced in phases; confirm the current obligations and deadlines against the official text before you act.
10Frequently asked questions
Who do I have to notify after a data breach in India?
Two parties, under Section 8(6) of the DPDP Act, 2023: the Data Protection Board of India, and each affected data principal, meaning each person whose personal data was involved. Both must be told. Notifying the regulator but not the individuals, or the individuals but not the regulator, does not meet the requirement.
How quickly must a data breach be reported under the DPDP Act?
The Act requires intimation; the DPDP Rules, 2025 set the timing. The structure is a prompt initial intimation describing the breach, followed by a fuller report to the Board within a short follow-up window. Because the Rules were notified in November 2025 and are commenced in stages, confirm the exact deadline for your facts against the official text rather than relying on a fixed number of hours.
Is there a minimum size of breach that has to be reported?
On the face of the Act, no. The definition of a personal data breach carries no materiality threshold, so there is no clear carve-out for breaches said to be too small to matter. Many Indian businesses therefore treat every suspected incident as reportable until it has been assessed, rather than guessing where the line is.
What are the penalties for a data breach under the DPDP Act?
The Act's Schedule sets penalties imposed by the Data Protection Board, including up to Rs 250 crore for failing to take reasonable security safeguards, and a separate penalty for failing to give the required breach intimation. These are maximums; the Board fixes the actual amount based on the gravity, duration and impact of the default and the steps taken to mitigate it. An appeal lies to the TDSAT.
What should I do in the first hour of a suspected breach?
Contain the exposure, note when you became aware, assess what data and how many people are affected, prepare the Board notice and the notices to affected people in parallel, report promptly without waiting for full certainty, and document every step. The reporting windows run from when you became aware, so an accurate timeline is important.