Lesson 5.7: Incident response plan and drills

Module 5 · Lesson 5.7 of 8 · About 30 minutes · Incident response plan and drills

A plan you have practised is the best protection. This DPDPA 2023 course page explains incident response plan and drills in plain language.

incident response plan and drills - DPDPA 2023 course lesson banner

What you will learn about incident response plan and drills

Write a one-page plan
Assign roles
Run a drill

One-page plan (incident response plan and drills)

Name the incident lead, the decision-maker, the communicator and the technical responder. Write the first hour as a checklist.

First 24 hours

Select a numbered box to read more.

Tap or click a step to see exactly what to do.

Roles (incident response plan and drills)

Role	Duty
Lead	Runs the response
Technical	Contain and investigate
Communicator	Prepares notices
Records	Keeps the log

Worked example

The team practises a mock breach every six months. They found that nobody knew where the Board portal login was kept, and fixed it.

Activity (5 minutes) (incident response plan and drills)

Schedule a 30-minute tabletop drill with your team.

Key takeaway: Keep a printed copy of the plan. Your systems may be down when you need it.

Check your understanding of incident response plan and drills

Q1. A plan should name:

Q2. Drills should be:

Q3. After an incident write:

← Reporting to the Board: the 72-hour rule Security and breach practice and module test →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for incident response plan and drills: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.