DPDP Breach Response: Build Your 72-Hour Plan
The DPDP Rules expect a detailed breach report to the Data Protection Board within 72 hours. A plan with clear roles, fast triage and good evidence makes that possible.
In this article
A personal data breach is stressful for everyone involved. Systems may be down, customers may be calling and nobody is quite sure what happened yet. That is exactly the moment when a clear plan pays for itself.
Under the DPDP Rules, a personal data breach must be intimated to the affected people and to the Data Protection Board, with a detailed report to the Board within 72 hours. This guide shows how to build a plan that makes that achievable, even on a bad day.
1. Set the roles before anything happens
The first hours of a breach are lost when people argue about who should decide. Agree the roles in advance and write them down in a one-page plan that sits outside your main systems, so it is available even if email or the intranet is affected.
A typical small team needs an incident lead who runs the response, a technical lead who investigates, a privacy or legal contact who handles notifications, and a communications owner who speaks to customers. In a smaller company one person may hold two roles. That is fine, as long as everyone knows who holds which.
Keep a contact list with phone numbers for each role and a backup for each person. Include key vendors, such as your cloud provider and any company that processes data for you, because a breach often starts or spreads through a supplier.
Decide in advance who can approve spending in an emergency, such as bringing in outside forensic help, and who signs off on messages to customers. Those two decisions cause more delay than almost anything else in the first day.
The time to decide who makes the call is before the incident, not during it.
2. Triage fast, then confirm
Not every security alert is a personal data breach. Triage is about answering a few questions quickly so you can decide whether the notification duties apply. A clear sequence helps.
Contain first.
Stop the leak if you can: revoke keys, disable accounts, isolate systems. Record what you did and when.
Establish what data is involved.
Identify which systems and which categories of personal data are affected, using your data inventory.
Estimate who is affected.
Work out which people, customers or employees may be affected, even if the first estimate is rough.
Decide on notification.
With your privacy contact, decide whether this is a personal data breach under the DPDP Rules and start the notices.
Keep investigating.
Refine the facts as you learn more, and update your records for the detailed report.
Speed matters, but accuracy matters too. It is usually better to send an honest early notice that says what you know so far than to wait for perfect information. Check the Rules for the exact content each notice needs, and prepare templates in advance.
3. Inform the right people and keep the evidence
Two audiences need to hear from you: the people whose data is affected, and the Data Protection Board. The message to individuals should be plain and practical. Tell them what happened, what data was involved, what you are doing about it and what they can do to protect themselves.
The report to the Board is more detailed. Prepare a template now with sections for the timeline, the nature of the breach, the data and people involved, the likely impact, the steps taken and the steps planned. When an incident happens, your team fills in facts rather than drafting from scratch.
Evidence is the thread that ties everything together. Keep logs, screenshots, decisions and timestamps in one secure place. Note who knew what and when. This record supports the detailed report, helps any later review and shows that you acted with care.
If your business also falls under other reporting rules, such as the CERT-In directions for certain cyber incidents, map how the timelines fit together so that one investigation feeds every report.
After a real incident, hold a short review. What worked, what was slow, and what will you change? Update the plan, the contact list and the templates while the lessons are fresh, and share a summary with leadership so the improvements get the time and budget they need.
A tabletop exercise is the best test. Walk through a realistic scenario with the people named in the plan and time each step. You will find gaps, and that is the point. Our DPDP compliance service and VAPT team can help you design a plan and a drill that fit your systems, if you would find that useful.