How to Respond to a Data Breach in 72 Hours (Rule 7)

A personal data breach is any unauthorised access, disclosure, alteration, loss or destruction of personal data that harms confidentiality, integrity or availability. Rule 7 gives you two duties: tell each affected person, and tell the Board with a detailed report within 72 hours. This DPDPA 2023 course page explains how to respond to a in plain language.

The breach flow (tap each step) (how to respond to a)

72-hour clock

The Rules state 72 hours for the detailed report. Check the Rule text for how the period is counted in your case.

Template 1: message to affected people (Rule 7(1)) (how to respond to a)

Subject: Important notice about your personal data

What happened: On [date] we found that [short description].
What data: [list of data, e.g. name, email, phone].
When and how many: Between [start] and [end]. Your data was among those affected.
What this may mean for you: [likely consequences, e.g. spam, phishing].
What we have done: [steps taken to contain and reduce risk].
What you can do: [change password, watch for suspicious messages, contact your bank if payment data].
Contact: [name, role, email, phone] for any questions.

Template 2: report to the Board (Rule 7(2))

Part A (without delay): nature of breach, extent, time and place, likely impact.
Part B (within 72 hours or the extended period):
1. Updated facts and the events and circumstances that led to the breach
2. Mitigation steps taken
3. Findings about who caused it (if known)
4. Remedial steps to stop it happening again
5. Report on notices given to affected people (copy attached)

Evidence to keep (how to respond to a)

• Timeline with times in IST
• Logs, screenshots, emails
• List of affected people and when each was notified
• Decisions taken and by whom
• Copy of what was sent to the Board

Run a drill

Once a year, pick a made-up incident (a laptop with customer data is stolen). Time how long it takes to contain, assess, draft both notices and send them. Note the gaps and fix them.

Related guides (how to respond to a)

• How to Meet the Security Safeguards
• Governance and Records

Educational material, not legal advice. Based on the DPDP Act, 2023 and the DPDP Rules, 2025 (Gazette notification of 13 November 2025). Always check the official text on the MeitY website.