# DPDP Rules 2025, Rule 7: data breach notification and 72 hours

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/rules/rule-7-intimation-of-personal-data-breach/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

Digital Personal Data Protection Rules, 2025. Secondary-sourced from the PIB release and cross-checked sources; verify against the notified Gazette text before external use.

## Rule 7, intimation of personal data breach

**Two audiences, two clocks.**

**To each affected Data Principal, Rule 7(1): without delay**, through her registered contact or
user account, describing:
- the **nature, extent and timing** of the breach;
- the **likely consequences** relevant to her;
- **mitigation measures** implemented or being implemented;
- **safety measures she can take** to protect her interests;
- **contact details** of a person able to answer queries.

**To the Board, Rule 7(2): two stages.**
1. **Without delay**, on becoming aware: a description of the breach, including its nature, extent,
   timing and location of occurrence, and the likely impact.
2. **Within 72 hours** of becoming aware (or a longer period the Board allows on written request),
   an updated and detailed report covering:
   - broad facts, and the events, circumstances and reasons leading to the breach;
   - measures implemented or proposed to mitigate risk;
   - findings regarding the person who caused the breach;
   - remedial measures taken to prevent recurrence;
   - a report on the intimations given to affected Data Principals.

**Points to hammer in advice:**
- **No harm or materiality threshold**, from Act s.8(6). Every breach as defined in s.2(u) is in
  scope, including **loss of access**, so ransomware and serious availability incidents qualify.
- The **individual notice is "without delay"**, not 72 hours. Do not let a client build a process
  that batches user notification behind the regulator report.
- The 72-hour clock runs from **becoming aware**, and the Board's report requires you to have
  already identified the cause and the person responsible, which is a demanding forensic ask.