Introduction
Data breaches are inevitable in today's digital landscape. The DPDP Act establishes clear timelines and requirements for breach notification. This article provides a comprehensive guide to data breach response under the DPDP Act.
DPDP Rule 7: Breach Notification Timeline
Under Rule 7 of the DPDP Rules, data fiduciaries must notify the Data Protection Board within 72 hours of becoming aware of a data breach.
What to Tell Affected Individuals
Affected individuals must be informed of the breach, including:
To see a real-world example of how a failure to respond leads to severe consequences, check out our Healthcare Data Breach Case Study.
- The nature of the breach
- Type of data compromised
- Potential impact
- Remedial actions taken
- Contact details for queries
72-Hour Detailed Report
The detailed report to the Board must include:
- Cause of the breach
- Number of affected individuals
- Type of data compromised
- Immediate remedial actions
- Long-term preventive measures
Conclusion
Preparation is key to effective breach response. Organisations must invest in robust security infrastructure and have a well-documented incident response plan.
Related Reading
- Data Protection Board of India — Where you report breaches
- Penalties for Breach — Up to ₹250 crore
- Healthcare Data Breach Case Study — Real-world example