# India DPDP Act — personal data breach notification

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_ss_62000112443_e2f531dda3-india-dpdp-act-personal-data-breach-notification
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Data Breach Notification](https://support.icompaas.com/support/solutions/62000112443) › [Topics](https://support.icompaas.com/support/solutions/folders/f_gen_62000112443_topics)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Digital Personal Data Protection Act, 2023 §§ 8(6), 25

### What the DPDP Act requires

Section 8(6) requires every Data Fiduciary to **intimate the Data Protection Board of India and each affected Data Principal** in the event of a personal data breach. The form, manner, and timelines are set by the rules notified by the Central Government.

### Operating under the draft rules

The draft DPDP Rules require Data Fiduciaries to:

-   Notify **each affected Data Principal** without delay, with a description of the breach, its likely consequences, measures taken, recommended user actions, and a contact point.
-   Notify the **Data Protection Board** within **72 hours** of becoming aware (the rules carve out a longer time for genuine investigative complexity, with reasons).

(Final rules may adjust the window; iCompaas adapts the workflow as the Act is operationalised.)

### Significant Data Fiduciaries

If you are notified as a Significant Data Fiduciary, additional obligations apply — an India-based Data Protection Officer, periodic DPIAs and audits, and enhanced cooperation with the Board.

### Cross-border implications

For organisations also subject to GDPR, the same incident frequently triggers parallel notifications. The Privacy module maps a single incident to all applicable regulators (DPB India, EU SAs, ICO, etc.) and tracks the deadlines independently.

## Related compliance guidance

- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): Breach notification under Articles 33 and 34: the 72-hour clock, what to record and when to notify individuals.
- [HIPAA compliance for SaaS: a practical implementation guide](https://support.icompaas.com/compliance/hipaa): The HIPAA Breach Notification Rule timelines and thresholds for covered entities and business associates.
- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): Breach reporting duties to the Data Protection Board and affected Data Principals under the DPDP Rules.