Under Section 8(6) of the DPDP Act 2023, failure to notify a personal data breach carries penalties of up to ₹250 crore. Here is the operational runbook for technical and legal teams facing a security incident.
Section 8(6) states: "In the event of a personal data breach, the Data Fiduciary shall give the Board and each affected Data Principal, intimation of such breach, in such form and manner as may be prescribed."
Under the definition in Section 2(u), a personal data breach means any unauthorized processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction of or loss of access to personal data, that compromises the confidentiality, integrity, or availability of personal data.
Disconnect compromised servers, rotate administrative API credentials, preserve immutable disk forensics, and instruct external legal counsel to establish attorney-client privilege over investigation notes.
Analyze exposed databases against RoPA records. Identify whether breached files contain passwords, financial identifiers, government IDs (Aadhaar/PAN), or children's data.
Submit the statutory notification to the Board detailing root cause, scope of compromise, technical safeguards breached, and active containment actions taken.
Direct communication to affected individuals via email/SMS advising them of the incident, measures taken, and protective steps (e.g. password changes, monitoring accounts).
Organizations must coordinate DPDP breach reporting with CERT-In cybersecurity directions (which mandate reporting designated cyber incidents within 6 hours). While CERT-In focuses on technical threat containment and national infrastructure security, the DPBI focuses on personal data protection and harm to individuals.
LLM Advocates provides rapid incident counsel, forensic coordination, and statutory notice drafting.
Contact Emergency Breach Counsel