Lesson 5.6: Reporting to the Board: the 72-hour rule

Module 5 · Lesson 5.6 of 8 · About 30 minutes · The 72 hour rule

The clock matters. Learn the two steps. This DPDPA 2023 course page explains the 72 hour rule in plain language.

the 72 hour rule - DPDPA 2023 course lesson banner
Advertisement

What you will learn about the 72 hour rule

  • Describe the two-step report
  • Know the 72-hour deadline
  • Prepare the contents

Rule 7(2) (the 72 hour rule)

Inform the Board without delay with a description of the breach including nature, extent, timing and location and likely impact. Then, within 72 hours of becoming aware, or a longer period the Board allows on request, give updated and detailed information: broad facts, events and circumstances, reasons for the breach, mitigation, findings about the person who caused it, remedial measures to prevent recurrence, and a report on the notices given to affected principals.

Board report timeline

Select a numbered box to read more.

1Hour 0Aware2Without delayInitial report3Within 72 hoursDetailed report4AfterFollow-up
Tap or click a step to see exactly what to do.
Advertisement

Parallel reporting (the 72 hour rule)

RegimeDeadline
DPDP Rules, 2025Without delay, then 72 hours
CERT-In directions (separate)6 hours for specified incidents

Worked example

A fintech detects unusual downloads on Monday 10:00. It reports briefly to the Board by Monday evening and files the detailed report on Wednesday morning, inside 72 hours.

Activity (5 minutes) (the 72 hour rule)

Use the calculator in How to respond to a data breach to set your own clock.

Key takeaway: The clock starts when you become aware, not when the investigation ends.

Check your understanding of the 72 hour rule

Q1. The detailed report to the Board is due within:

Q2. First report to the Board is:

Q3. CERT-In reporting is:

← Telling affected people: Rule 7(1)Incident response plan and drills →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for the 72 hour rule: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.