ComplyDP6 minutes
DPDP 72-Hour Breach Intimation Checklist for Data Fiduciaries
An operational runbook for legal heads to manage data breach intimations to the DPBI and affected Data Principals under the DPDP Act 2023 and Rules 2025.
Last updated:
When to use this checklist
A compromised KYC database requires immediate action. The General Counsel evaluates liability and manages overlapping regulator notifications for the RBI or IRDAI. Use this checklist when the Security Operations Center flags a confirmed personal data breach. It guides compliance teams from incident discovery to DPBI intimation.
Prerequisites for immediate response
Legal teams need prepared templates before a crisis occurs. They require a pre-mapped data inventory. Maintain an updated list of Data Processors engaged under Section 8 of the Digital Personal Data Protection Act, 2023. The organization designates an active DPO and establishes contact routing for the Data Protection Board of India.
Step-by-step 72-hour breach response runbook
1. Contain the incident and log discovery. Isolate affected systems and record the exact time of discovery. Generate unalterable system logs as evidence. 2. Assess processor liability. Review Section 8 contracts to confirm if a Data Processor caused the breach. Request their internal logs immediately. 3. Intimate affected Data Principals. Send an itemised notice to Data Principals in India without delay. Keep time-stamped dispatch records from the customer communication platform. 4. Submit the DPBI intimation. File the detailed breach report to the Board within 72 hours of discovery. Retain the acknowledgment receipt from the digital portal.
Navigating Section 33 penalty exposure
Section 33 grants the Board authority to impose monetary penalties based on inquiry findings. Investigators review the nature, gravity, and duration of the breach. They assess whether the fiduciary took immediate action to mitigate effects. Documenting containment steps creates legal defensibility. A swift response alters the penalty calculation. Delayed reporting increases financial exposure.
Effort and budget reality for legal teams
Building this workflow takes cross-functional time. A large bank spends upwards of 200 hours mapping IT incident response to legal notification duties. Manual compliance relies on spreadsheets and frantic email chains. Tooled solutions automate the dispatch of notices. They maintain an exportable audit trail of notified individuals. Budgeting for automation limits outside counsel spend during the 72-hour window.
Required documentation pack
The incident response binder requires specific DPDP updates. The breach policy names the DPO as the final authority on DPBI submissions. An incident register uses dedicated fields for Section 33 mitigation tracking. Processor addendums enforce a 24-hour notification deadline to the Data Fiduciary. This ensures the 72-hour clock remains manageable.
Red flags indicating audit failure
1. Legal learns of a breach days after IT containment. 2. Processor contracts lack mandatory data breach notification clauses. 3. The firm has no mechanism to identify which specific Data Principals belong to a compromised database segment. Verify incident response capabilities before an actual breach occurs. Use the scanner at https://www.complydp.com/audit-preview to locate gaps in breach intimation workflows.
Sources
Frequently asked questions
How long do we have to notify the DPBI of a data breach?
Under the DPDP Rules, 2025, a Data Fiduciary intimates the Data Protection Board within 72 hours of becoming aware of the breach. The notice to affected Data Principals happens without delay.
Can we rely on our Data Processors to handle the breach reporting?
No. Section 8 makes the Data Fiduciary responsible for compliance irrespective of any agreement. The fiduciary handles the regulator intimations directly. They can claim indemnity against the processor later.
What factors influence the penalty amount under Section 33?
The Board examines the nature, gravity, and duration of the breach. Inquiries evaluate the mitigation actions taken by the fiduciary. Investigators check whether the person realized any financial gain or avoided a loss. Documented containment efforts limit exposure.
How does DPDP breach reporting interact with RBI requirements?
Banks and NBFCs manage concurrent reporting timelines. The RBI dictates separate cyber security incident reporting windows. The DPDP Rules mandate the 72-hour DPBI notification specifically for personal data compromises.
What should a legal team budget for breach response readiness?
Preparing a compliant workflow takes large enterprises over 200 hours of cross-departmental planning. Automating notification logs reduces reliance on outside counsel during an active crisis. This provides an exportable audit trail.