Never Miss the 72-Hour Breach Window

Under DPDPA S.8(6), the 72-hour window begins the moment a Data Fiduciary "becomes aware" of a personal data breach. DPDPA Shield logs the exact UTC timestamp when you create an incident record — establishing a clear, defensible start time in your evidence trail. This timestamp is immutable and cannot be edited after the fact.

The prescribed notification format must include: (1) nature of the breach and categories of personal data affected, (2) estimated number of data principals affected, (3) likely consequences of the breach, (4) remediation and mitigation measures taken or proposed, and (5) contact details of your Data Protection Officer. DPDPA Shield pre-fills this from your incident data — you review and send in one click.

Yes, S.8(6) also requires notifying affected data principals "in such manner as may be prescribed." DPDPA Shield handles batch email notification to all affected principals with delivery receipts stored in an immutable log. The notification content, timestamps, and delivery status are all included in your regulator evidence package.

Failure to notify the Data Protection Board within 72 hours carries a penalty of up to ₹200 crore under S.8(6) — separate from any penalty arising from the breach itself. There is no grace period. The DPDPA Shield countdown timer with auto-escalation and Slack war-room alerts is specifically designed to prevent this outcome.