Notification
The legal requirement to report the breach.
🎯 Learning Objectives
- ▸ Understand the notification requirements
- ▸ Learn what information to include in the report
- ▸ Analyze the consequences of non-notification
Reporting to the Board
Under Section 8(6), the Data Fiduciary must notify the Data Protection Board and the affected Data Principals. The notification must include:
- • The nature of the breach.
- • The categories and number of data subjects affected.
- • The likely consequences of the breach.
- • The measures taken or proposed to address the breach.
- • The contact details of the DPO or Privacy Officer.
While the DPDPA says "without undue delay," industry practice and GDPR alignment suggest the Board will expect an initial notification within 72 hours of becoming aware of the breach.
Notifying Individuals
You must notify affected Data Principals without delay if the breach is likely to result in a high risk to their rights (e.g., financial loss, identity theft). The notification should be clear and in plain language.
💡 Example
If a bank leaks credit card data, it must notify the Board and immediately send an email/SMS to affected customers warning them and advising them to block their cards.
📖 Glossary
- Undue Delay
- A delay that is unreasonable or without good cause.
- Data Breach Notification
- The formal process of informing authorities and individuals about a data security incident.
🔑 Key Takeaways
- Notify the Board "without undue delay" (usually interpreted as 72 hours).
- Notify affected users if there is a high risk of harm.
- Failure to notify can result in a ₹200 crore penalty.
📚 Further Reading
- DPDPA Section 8(6) — Government of India (2023)
Shilpi Kulshrestha
Shilpi is a corporate lawyer with over a decade of experience in data protection, company law, and regulatory compliance. She has advised 50+ startups and enterprises on DPDPA readiness, privacy gover...