IndiaDigital Personal Data Protection Act, 2023, breach notification duties
Digital Personal Data Protection Act, 2023 (DPDPA), No. 22 of 2023, breach notification, s.8(6)
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app must notify the Data Protection Board and each affected data principal of a personal data breach, including one covering a biometric identifier, without delay, and must supply the Board a detailed follow-up report within 72 hours of becoming aware of the breach.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Under challenge
- Yes
- Open questions
- Does the seventy-two hour period in Rule 7(2)(b) of the Digital Personal Data Protection Rules, 2025 run only from the Data Fiduciary itself 'becoming aware of the breach' or also from its Data Processor doing so, given that section 8(1) holds the Data Fiduciary responsible for processing undertaken 'on its behalf by a Data Processor'?
- How much must a Data Fiduciary know before the duty to intimate each affected Data Principal 'without delay' under Rule 7(1) starts, given that the intimation is owed only 'to the best of its knowledge'?
What it makes you log
Logging duty
Section 8(6) requires the Data Fiduciary to give the Board and each affected Data Principal intimation of a personal data breach in the form and manner prescribed. It is a duty to notify and sets no duty to document breaches, and it names no log or record. Rule 7 of the Digital Personal Data Protection Rules, 2025, which the summary describes, is likewise a notification; the log duties in those Rules sit in Rules 6 and 8 and are carried by the Rules row.
- Kind
- None
- As of
What this law does
Section 8(6) requires a Data Fiduciary to give the Board and each affected Data Principal intimation of a personal data breach, in the form and manner prescribed. Rule 7 fills in that detail: notify each affected Data Principal without delay, notify the Board without delay with an initial description, then supply a detailed follow-up report within 72 hours of becoming aware of the breach, or such longer period as the Board allows.
Neither provision is currently in force: s.8 sits in the sections-3-to-17 bucket, appointed by Notification G.S.R. 843(E) () to commence eighteen months after its own publication date, ; Rule 7 sits in the parallel rules-3-to-16 bucket, appointed to the same date by the Rules' own Rule 1(4).
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .