What the DPDP Act requires
Section 8(6) requires every Data Fiduciary to intimate the Data Protection Board of India and each affected Data Principal in the event of a personal data breach. The form, manner, and timelines are set by the rules notified by the Central Government.
Operating under the draft rules
The draft DPDP Rules require Data Fiduciaries to:
- Notify each affected Data Principal without delay, with a description of the breach, its likely consequences, measures taken, recommended user actions, and a contact point.
- Notify the Data Protection Board within 72 hours of becoming aware (the rules carve out a longer time for genuine investigative complexity, with reasons).
(Final rules may adjust the window; iCompaas adapts the workflow as the Act is operationalised.)
Significant Data Fiduciaries
If you are notified as a Significant Data Fiduciary, additional obligations apply — an India-based Data Protection Officer, periodic DPIAs and audits, and enhanced cooperation with the Board.
Cross-border implications
For organisations also subject to GDPR, the same incident frequently triggers parallel notifications. The Privacy module maps a single incident to all applicable regulators (DPB India, EU SAs, ICO, etc.) and tracks the deadlines independently.