DPDP Data Breach Reporting: What Facility Teams Must Do

Published on 10/18/2026 • Updated on 10/22/2026

A security supervisor finds that the visitor register from last month is missing from the reception desk. A vendor emails to say a spreadsheet of contractor phone numbers went to the wrong address. A laptop with employee files is stolen from a car. Each is a possible personal data breach, and under the Digital Personal Data Protection Act, 2023 each can trigger a duty to tell people and the regulator.

This guide explains the breach duty in the Act and Rule 7 of the DPDP Rules, 2025, what counts as a breach, the timeline, what a notice must say and how a facility team can prepare a response plan in a day. It is general information, not legal advice. Confirm the details with your legal adviser.

What counts as a personal data breach

The Act defines a personal data breach as any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability. The definition is wide. It covers hacking and also a lost register, a misdirected email and a misplaced USB drive.

What the law requires

Section 8(6) of the Act requires a Data Fiduciary to intimate the Board and each affected Data Principal of a personal data breach. Rule 7 says how. The Press Information Bureau release of 17 November 2025 describes it as intimation to affected persons without delay, and to the Board without delay, with detailed information within 72 hours.

The penalty for failing to give notice of a breach is up to Rs 200 crore under the Schedule. Rule 7 and the other main duties begin after eighteen months from publication of the Rules, around mid-May 2027. Confirm the exact date with your adviser.

What to tell affected people

Rule 7 asks that the message to each affected person be clear and plain, and say in substance what happened, when, the likely consequences, the steps taken to reduce risk, what they can do to protect themselves and a contact to ask questions.

The sample is invented for illustration. Write each notice for the real facts and keep it short.

What to tell the Board

The report to the Board has two parts. The first is an early intimation without delay. The second, within 72 hours or a longer period the Board allows, carries details such as the nature, extent, timing and location of the breach, the likely impact, the person who caused it if known, the steps taken and the notices sent. Check the exact list in Rule 7 with your adviser before you finalise your template.

A one-day response plan

Print the plan and keep it at the security desk and with the admin head. A plan on a shared drive is useless during a ransomware attack.

Who does what in a facility

Breaches rarely stay inside one department, so agree the roles before you need them.

Give each role a deputy, because breaches do not wait for people to come back from leave. Put phone numbers on the sheet, not only email addresses, as email may be the thing that is down.

After the event, hold a short review. Ask what was found late, what slowed the notice and what small change would prevent a repeat. Write the answers into the plan, and share the updated plan with every team that holds personal data. A plan that only the admin head has read will not help when he is away. Store a printed copy where the night shift can find it, and note the date of the last review on the front page. Keep a short log of every near miss as well, such as a wrongly addressed email caught before sending, since these show where the next real breach could start.

A worked timeline

The key step was the decision at 10:30. Without a named person the same events can take three days to start.

Prevention that shrinks the problem

• Keep fewer fields. Data you never collected cannot leak.
• Replace paper registers with a system with named logins.
• Mask phone numbers on screens and exports.
• Delete old records on a schedule.
• Check vendor contracts for breach alert terms.

Rule 6 expects reasonable safeguards, and the largest penalty tier applies if they are missing. Prevention is cheaper than a notice to hundreds of people.

Common mistakes

Another mistake is telling only IT. Security, HR and admin hold personal data in files, registers and phones, and any of them can be the first to notice a breach.

A third is deleting evidence in a panic. Keep logs, emails and photographs, since the Board may ask for them.

A one-day readiness plan

Set up the basics well before the commencement date.

Repeat the drill every six months and update the contact sheet when people change.

Five-minute self-check

Check your readiness against these points.

Two or more no answers mean this is worth fixing before anything else on your list.

Reader Q&A

Bottom line

A breach duty is mostly about speed and clarity. Name a decision maker, write down the facts, tell people in plain words and report to the Board on time.

Spend one day on the plan, one hour on a drill, and review both every year.

Author of the Blog Post

Aadeshwar Modi

Technical Content Writer at VisitorFlow

Aadeshwar Modi is a marketing technical content writer who loves writing on technology and AI topics.