What are the statutory requirements for Personal Data Breach In India under India's DPDP Act, 2023?
Under Section 8(6) of the DPDP Act, 2023 read with DPDP Rules 2025, every Data Fiduciary must intimate personal data breaches without delay to the Data Protection Board of India and each affected Data Principal. Failure to notify or implement reasonable security safeguards triggers statutory penalties up to ₹250 Crore under the Schedule to Section 33.
Comprehensive Legal Breakdown
1. Statutory Framework & Applicable Provisions under DPDP Act, 2023
The Digital Personal Data Protection Act, 2023 creates a mandatory rights-based regime for digital personal data in India. In the context of Personal Data Breach In India, organizations acting as Data Fiduciaries (or Data Processors under contract) must ensure processing strictly rests on affirmative consent (Section 6) or specific legitimate uses (Section 7). Notice under Section 5 must clearly describe the exact personal data collected, processing purposes, and the Data Protection Officer contact details.
2. Technical & Organizational Safeguards (Section 8(4))
Section 8(4) establishes an affirmative obligation to implement reasonable security safeguards to prevent personal data breach. For Personal Data Breach In India, this necessitates role-based access controls, TLS 1.3 encryption in transit, AES-256 encryption at rest, complete data flow mapping, and an immutable audit trail. Failure to protect personal data incurs statutory penalties up to ₹250 Crore under the Schedule to Section 33.
3. Data Principal Rights & One-Click Revocation (Sections 11–14)
Data Principals possess statutory rights to access information about processing (Section 11), demand correction or erasure of personal data that has served its purpose (Section 12), readily withdraw consent with comparable ease (Section 6(4)), access grievance redressal within specified timelines (Section 13), and nominate a representative in the event of death or incapacity (Section 14).
4. Enforcement, Inquiries & Board Adjudication (Sections 18–33)
The Data Protection Board of India operates as a digital-by-design regulatory authority empowered to conduct inquiries, call for information under Section 36, summon digital records, direct blocking of access under Section 37 for persistent violators, and impose substantial monetary penalties up to ₹250 Crore per contravention.
Enterprise Action Checklist
Interactive compliance tracker — click each control to track audit readiness.