Back to Module
1 of 4|Incident Response
video 15 min•Incident Management
Incident Detection
How do you know you have been breached?
🎯 Learning Objectives
- ▸ Understand the sources of breach detection
- ▸ Learn the importance of early detection
How Breaches are Found
A personal data breach includes unauthorized access, loss, destruction, or alteration of data. You might detect it through:
- • Internal Security Tools: SIEM alerts, unusual database access.
- • Employee Reporting: An employee notices something suspicious.
- • Customer Complaints: Users report strange activity or phishing emails.
- • Third-Party Notification: A vendor or researcher informs you.
- • Law Enforcement: Police notify you of a compromised server.
The DPDPA requires you to report a breach "without undue delay." If you take 3 months to realize you were breached, the Board will penalize you for lack of monitoring.
📖 Glossary
- SIEM
- Security Information and Event Management, software that monitors systems for suspicious activity.
🔑 Key Takeaways
- Most breaches are detected by third parties (law enforcement, customers, researchers).
- You need internal monitoring tools to detect breaches yourself.
- A delay in detection increases the penalty.
📚 Further Reading
- DPDPA Section 8(6) — Government of India (2023)
Course Author
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...