DPDP Breach Notification: What Rule 7 Requires in the First 72 Hours, and What Your Vendor Contract Must Add

What counts as a personal data breach under the DPDP Act?

Section 2(u) of the Act defines a personal data breach as any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability. That is far wider than the popular idea of a hacker stealing a database.

Read literally, a data breach under the DPDP Act includes a payroll executive emailing a salary sheet to the wrong client, a ransomware attack that locks staff out of patient records without copying anything, a support agent looking up a celebrity customer’s address out of curiosity, and a misconfigured storage bucket that exposed files even if nobody is known to have opened them. Loss of availability counts. So does an internal misuse.

Rule 7 then applies to “any personal data breach”. Unlike some foreign laws, it contains no materiality threshold and no exception for breaches that are unlikely to cause harm. Until the Board issues guidance or practice develops, the safer reading is that every incident within section 2(u) must be intimated, with the severity reflected in the content of the notice rather than in a decision not to notify.

What does Rule 7 require, and by when?

Section 8(6) obliges the data fiduciary to give the Board and each affected Data Principal intimation of a breach in the prescribed form and manner. Rule 7 of the Rules prescribes it. There are three separate communications, and each has its own timing and content.

When does the DPDP breach notification timeline start?

Every clock in Rule 7 runs from the fiduciary “becoming aware” of the breach. The Rules do not define awareness, and the Board has not yet said whether it means confirmation of a breach or a reasonable suspicion. A cautious business will treat the moment a responsible person has reasonable grounds to believe a breach has occurred as the start, and will record that time.

“Without delay” has no fixed number of hours. It is likely to be read as soon as the fiduciary can describe the breach with reasonable accuracy, which in most cases means hours, not days. The first notice to the Board under Rule 7(2)(a) is deliberately short; the detail comes later.

The DPDP breach notification 72 hours window applies only to the detailed report under Rule 7(2)(b). It can be extended, but only by the Board, on a request made in writing. An internal decision that more time is needed is not an extension. If an investigation will clearly overrun, file the request before the 72 hours end and explain why.

Who must notify: the fiduciary or the vendor?

Section 8(6) places the duty on the Data Fiduciary, the business that decides the purpose and means of processing under section 2(i). A Data Processor, defined in section 2(k) as anyone processing on a fiduciary’s behalf, has no statutory duty to notify the Board or individuals. Section 8(1) makes the fiduciary responsible for processing done on its behalf “irrespective of any agreement to the contrary”.

So when a Pune payroll vendor is breached, the Bengaluru SaaS company whose employee salaries it processes is the one that must send the breach intimation to the Data Protection Board and to every affected employee. The vendor’s silence is not a defence.

This creates the central gap. The fiduciary’s 72 hours run from its own awareness, yet the Act and Rules set no deadline for a processor to tell its customer. A vendor could take a week to disclose without breaching the DPDP Act or Rules, though it may breach its contract. The only protection is a contractual notice deadline, which is recommended practice rather than a legal requirement.

A breach runbook for a 100-person company

Consider a 100-person Delhi D2C brand with 3 lakh customers, a cloud host, a CRM, a logistics aggregator and a payroll vendor. It does not need a security operations centre. It needs a named owner, a short plan and templates prepared in advance. The steps below map to each Rule 7 item. The internal times are recommended practice, not law.

• Hour 0: log the time of awareness and who learnt of it. Appoint one incident lead with authority to decide on notices. This fixes the start of the Rule 7 clock.
• Hours 0 to 4: contain the incident and preserve evidence. Rule 6(1)(c) and (e) already require logs and their retention for one year, and those logs are what the detailed report will rely on.
• Hours 0 to 6: if the incident is a reportable cyber incident under the CERT-In directions of 28 April 2022 issued under section 70B(6) of the Information Technology Act, 2000, report it to CERT-In within six hours of noticing it. This is a separate duty that runs in parallel with the DPDP Act.
• Within the first day: send the Board the short description required by Rule 7(2)(a): nature, extent, timing, location and likely impact.
• Within the first day where possible: notify affected customers or staff under Rule 7(1) through their account or registered email or phone, using a pre-approved plain-language template covering items (a) to (e).
• By hour 72: file the detailed report under Rule 7(2)(b) items (i) to (vi), including a report on the customer intimations already sent, or file a written extension request before the deadline.
• After closure: record remedial measures, update vendor terms if a vendor caused the breach, and rehearse the plan once a year.

What should the vendor breach notice clause say?

Because the law is silent on processors, the contract has to carry the whole weight. A useful clause has four parts. None of them is required by the Act; each is recommended practice that lets the fiduciary meet its own Rule 7 duties.

• Timing: notice to the customer within a fixed short period of the vendor becoming aware, commonly 24 hours, and never “without undue delay” alone, which gives the customer no usable deadline.
• Content mirroring Rule 7: nature, extent, timing and location, data and individuals affected, likely impact, mitigation, causes, findings on who caused it and remedial steps, with updates as facts emerge.
• Cooperation: help with notices to individuals and the Board, access to logs and personnel, and no public statement or direct notice to the customer’s users without the customer’s approval.
• No admission: notice and cooperation do not by themselves amount to an admission of fault or liability, which makes vendors more willing to report early.

Penalties for getting breach notice wrong

Under section 33 and the Schedule, a breach of the obligation to give the Board or affected Data Principals notice under section 8(6) can attract a penalty of up to ₹200 crore. A failure to take reasonable security safeguards under section 8(5), which is often what caused the breach, can attract up to ₹250 crore. These are maximums. The Board imposes a penalty only after an inquiry and only where it finds the breach significant.

Section 33(2) lists the factors the Board must weigh, including whether the person took action to mitigate the effects of the breach and the timeliness and effectiveness of that action. Prompt, complete notice is therefore likely to count in a fiduciary’s favour even where the breach itself could not be prevented. Under section 27(1)(a), the Board may also direct urgent remedial or mitigation measures on receiving an intimation.

Penalties fall on the fiduciary. Whether a fiduciary can recover a regulatory penalty from a vendor under an indemnity is not settled in Indian law, which is one more reason to fix the notice deadline and liability terms before an incident.

How this compares with the GDPR 72-hour rule

The European GDPR also uses 72 hours, but the structures differ. Under the GDPR the controller notifies the supervisory authority within 72 hours of becoming aware, where feasible, unless the breach is unlikely to result in a risk to individuals. The DPDP Rules require a first notice to the Board without delay and the detailed report within 72 hours, and they apply to every breach, with notice to individuals in all cases. An EU-ready incident plan is a useful start, not a finished Indian one.

When do these duties start?

Section 2, including the definition of personal data breach, has been in force since 13 November 2025. Section 8, the penalty provisions and Rule 7 are scheduled to come into force on 13 May 2027 under notification G.S.R. 843(E) and Rule 1(4), as of October 2026. The government proposed in early 2026 to shorten the eighteen-month window; no notification changing the date had been published as of October 2026, so check the current position before relying on it.

Vendor contracts signed today will run past that date, which is why the notice clause belongs in them now. For the wider timeline see our guide on the DPDP enforcement timeline, and for penalty bands see our guide on DPDP penalties.

Why check your vendor contracts with ClauseAudit before 13 May 2027?

Under section 8(1) your business answers for every vendor that processes personal data for it. Penalties can reach up to ₹250 crore for security failures and up to ₹200 crore for breach-notice failures, and many vendor contracts signed before November 2025 are likely to say nothing about the DPDP Act, breach timelines or Rule 7 content.

You have three honest options. An advocate’s review is thorough and right for material deals, but slower and costlier per contract. A free checklist is fast, but you still have to read every clause yourself and judge each gap. The ClauseAudit DPDP Compliance Check reads a vendor agreement, data processing agreement or SaaS terms clause by clause in minutes, for ₹999 per contract plus GST. Every finding is labelled either required by the Act or Rules, with the section or rule, or recommended practice. You get the clause quoted, why it matters, a suggested fix, a redline and a negotiation email, from the customer or vendor side. The original document is not stored after the review.

It is an AI-assisted review and can miss things. For large or sensitive deals, children’s data at scale, or regulated sectors such as banking, insurance and health, have an advocate review the contract.

Related reading

See our guide on data processing agreement clauses for full wording, our guide on data fiduciary vs data processor roles, and our free data processing addendum template. The DPDP compliance checklist covers all 24 vendor contract checks. This guide is general information, not legal advice.