DPDP Rules 2025 are now in effect. How ready is your business? Most Indian companies don't know yet.Find out in 10 minutes — free →
Many Indian businesses have no formal incident response plan. A ransomware attack, leaked database, or accidental email disclosure that exposes customer or employee personal data triggers mandatory notification obligations under DPDPA. Failing to notify can result in penalties up to ₹200 crore. More importantly, delayed or mishandled breach communication dramatically erodes customer trust.
Businesses must develop or update incident response plans to include DPDPA notification requirements. Contracts with vendors and cloud providers must include breach notification SLAs. Security practices around access logs, encryption, and monitoring should be reviewed. Internal escalation protocols must be documented.
Section 8(6) of DPDPA requires every Data Fiduciary to notify the Data Protection Board (DPB) of a personal data breach 'in such manner and within such period as may be prescribed'. The DPDP Rules, 2025 require a two-stage notification: an initial report within 72 hours of becoming aware of the breach, followed by a detailed investigation report. Data Principals who are affected must also be informed, unless the breach is assessed as low-risk. Businesses should now build basic incident response capabilities: detection, containment, assessment, notification, and remediation. Reviewed: March 2026.
Designate a Data Protection point of contact internally
Create a basic incident response runbook with DPDPA notification steps
Review your cloud and vendor contracts for breach notification clauses
Test whether you can detect a data breach within 24 hours
Document what constitutes a 'personal data breach' for your business
Identify all systems containing personal data and their access logs
Prepare breach notification templates for the DPB and for customers
Free — takes 3 minutes
Answer a few simple questions. Get your free Readiness Score — sent to your email or WhatsApp.
Check My Readiness →Take our free 10-minute industry assessment to find out your compliance risk level.
Take Free Assessment →2-min reads, plain English, every morning. Free forever.
