Dual-Clock Breach Notification
Breach notification informs affected individuals and the Data Protection Board about a personal data breach.
Initial Rule 7 information is due without delay, followed by further Board details within 72 hours, subject to a permitted extension. CERT-In's separate six-hour reporting clock applies to covered cyber incidents.
Practical application
Maintain separate reporting decisions, clocks and escalation owners.
Common questions and examples
What is the DPDP data breach notification deadline?
Under final Rule 7, affected individuals and the Data Protection Board must receive the relevant initial intimation without delay after the fiduciary becomes aware of a personal data breach. Further particulars go to the Board within 72 hours, unless the Board permits a longer period on a written request. The 72-hour stage is not permission to postpone the initial notification. Check the commencement note below before applying these duties.
How does the CERT-In six-hour deadline differ?
CERT-In's directions separately require specified entities to report listed cyber incidents within six hours of noticing them or being brought to notice of them. Scope, recipients and triggers differ from DPDP reporting. A response plan should track both where applicable and should not wait for a complete forensic investigation before beginning required reporting.
Related concepts
Official sources and editorial review
Prepared by DPDPA Shield. Explanations are plain-language summaries; the cited legislation controls. Last reviewed .
Put privacy knowledge into practice
Explore consent, data inventory and rights-request workflows with DPDPA Shield.