Rule 7 of the DPDP Rules, 2025 has two layers. On becoming aware of a breach, tell each affected person and the Data Protection Board without delay. Then within seventy-two hours, or a longer period the Board allows on written request, send the Board updated and detailed information. Build the runbook around those two steps.
What goes to affected people
Rule 7(1) asks for a concise, clear and plain message, sent through the user account or a registered mode of contact. It must include:
- a description of the breach, including its nature, extent and timing
- the consequences likely to affect that person
- the measures taken and being taken to mitigate risk
- safety steps the person can take
- business contact details of someone who can answer queries
What goes to the Board
Rule 7(2) has two parts. Without delay, send a description including nature, extent, timing, location and likely impact. Within 72 hours, send:
- Updated and detailed information on that description.
- The broad facts, events, circumstances and reasons behind the breach.
- Measures implemented or proposed to mitigate risk.
- Any findings about the person who caused the breach.
- Remedial measures to prevent recurrence.
- A report on the intimations given to affected Data Principals.
A runbook that fits
Hour zero is when you become aware, so log that moment.
- Triage: confirm personal data is involved, and which Data Principals. Engineering needs to answer "which records" quickly.
- Contain, and preserve logs and evidence.
- Draft the user message from a template that already has the five elements.
- Send the first notice to the Board.
- Within 72 hours, assemble items 1 to 6 above. Fill the root cause section from your timeline, not from memory.
- If the investigation will run longer, decide early whether to request a longer period in writing.
Evidence to keep
After the event, keep the incident timeline, the exact wording of each message sent, the time each was sent, and the decision log on whether to ask for more time. The Board's report asks for a report on the intimations given to affected people, so the record of who was told, how and when is part of the deliverable, not an afterthought.
Where the other clocks sit
The CERT-In directions have a separate 6 hour rule for listed incident types, including data breach and data leak. The two regimes overlap, so one incident may need both. The comparison post in this series puts them side by side.
Why preparation matters more than the form
The hard part is not the form. It is finding out fast which users and which data were affected. Teams that keep a current inventory of data stores and an access log can answer that in hours.
Quick check
Does the 72 hours apply to telling users?
No. Users are told without delay. The 72 hours is for the detailed report to the Board.
Can the 72 hours be extended?
Rule 7(2)(b) allows a longer period if the Board grants it on a written request.
Sources
- Digital Personal Data Protection Rules, 2025 (MeitY)
- Digital Personal Data Protection Act, 2023 (MeitY)
Last reviewed: 19 October 2026.
