Partly. Under Rule 7 of the DPDP Rules 2025, you must tell the Data Protection Board and every affected person without delay. A detailed report to the Board follows within 72 hours of becoming aware, unless the Board allows longer. There is no materiality threshold, and CERT-In's six-hour reporting still applies in parallel. These duties apply from 13 May 2027.
To each affected Data Principal, without delay: what happened, the likely consequences, what you are doing to mitigate, what they can do to protect themselves, and a contact.
To the Board, without delay: a description of the breach, including its nature, extent, timing, location and likely impact.
To the Board, within 72 hours (or longer if the Board allows): updated facts, the circumstances and reasons, mitigation, any findings about who caused it, remedial steps to prevent recurrence, and a report on the notices sent to individuals.
| Regime | Who you notify | When |
|---|---|---|
| DPDP Rule 7 | Affected individuals | Without delay |
| DPDP Rule 7 | Data Protection Board (intimation) | Without delay |
| DPDP Rule 7 | Data Protection Board (detailed report) | Within 72 hours, or longer if allowed |
| CERT-In directions 2022 | CERT-In | Within 6 hours of noticing |
| GDPR Art. 33 (comparison) | Supervisory authority, if risk | Within 72 hours |
GDPR only requires regulator notification where a breach is likely to risk people's rights, and individual notification where that risk is high. The DPDP Act has no such filter: any personal data breach triggers the duties. A lost laptop with a small customer extract and a major intrusion follow the same process.
Failing to notify the Board or affected individuals carries a penalty of up to ₹200 crore under the Schedule to the Act. That sits alongside the ₹250 crore ceiling for failing to take reasonable security safeguards.
CERT-In's April 2022 directions under the IT Act require reporting specified cyber incidents within six hours of noticing them. That is a different regime with a different trigger, and DPDP does not replace it. Build one escalation path that serves both.
Board reporting, AI governance, DPDP readiness or CMMC. Tell me which and what the constraint is.
me@sarfarazchougule.com →