InfraVeritas360DPDPiqDPDP Insights › The law › Section 8(6) · Rule 7
The law
Section 8(6) · Rule 7: Telling people about a breach
On becoming aware of a personal data breach, tell each affected person and the Data Protection Board without delay. Send the Board a detailed report within 72 hours, or a longer period if the Board allows on request.
What it means in your sector
- Banking, financial services and insurance: One incident may go to CERT-In, your regulator and the Data Protection Board, each with its own clock.
- IT, ITeS, BPO and GCC: Clients' contracts often require notice within hours, because their own clock starts when you tell them.
- Central government: ministries and departments: Breaches must be reported to affected people and the Data Protection Board, in addition to CERT-In.
Questions where this section matters
- Something has gone wrong. What happens in the first 72 hours?
- What must a vendor contract say about personal data?
- Staff share personal data on WhatsApp and personal email. What do we do?
- What should the board of directors ask management about DPDP?
- How do we put DPDP into the risk register?
- One incident, many regulators: how do we meet every clock?
- A client's data is involved in an incident. Who tells whom?
- How do we stop staff looking at records they do not need?
Official text: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (MeitY). The DPDP Rules were notified on 13 November 2025. Consent Manager rules start on 13 November 2026. Most duties, including notice, security, breach reporting, retention, children's data and rights, start on 13 May 2027. A proposal discussed in early 2026 to bring this date forward had not been notified when this page was last reviewed.
Explore our research-built assessment platformsEach one comes out of the same InfraVeritas360 Foundation Layer research. Human-led, with no AI used.