In today’s digital ecosystem, where data forms the backbone of organisational operations, the risk of a cybersecurity incident is an ever-present reality. When a security incident occurs, a rapid and legally sound response is a matter of strategic necessity. Achieving this requires a comprehensive incident response strategy, at the very core of which lies the Data Breach Notice.
The term “personal data breach” is defined under the DPDP Act as any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to personal data, that compromises the confidentiality, integrity, or availability of personal data. In plain terms: if personal data has been accessed without authorisation, accidentally leaked, tampered with, deleted, or rendered inaccessible, it will be referred to as a personal data breach.
The notice sent by an entity in the event of a data breach is termed as a Data Breach Notice. According to the Act, two different notices have to be sent: one to the Data Protection Board of India [‘the Board’, the regulator under the Act] and the other to Data Principals [the term used in the Act to refer to individuals].
A Data Breach Notice is a formal regulatory and communicative document issued by an organisation in the event of a Personal Data breach. In simpler terms, it is an official alert that comprehensively explains that unauthorized access, alteration, destruction, or disclosure of user data has occurred.
It is an external compliance tool mandated by law. Its core function is to inform both the regulatory authorities and the affected individuals that their data has been compromised. It assists organisations in mitigating the fallout of a cyber incident, minimizing potential harm to users, and demonstrating adherence to the principles of transparency and accountability.
WHY MUST A DATA BREACH NOTICE BE MAINTAINED?
An effective Data Breach Notice is critical for crisis management and legal protection. It is useful for minimizing reputational damage by providing evidence that the organisation is handling the incident responsibly and taking immediate corrective action. At the same time, also facilitates regulatory compliance. Suppressing or delaying information about a breach can lead to severe financial penalties and loss of operational licenses. A timely notice ensures that the organisation’s crisis management practices align with statutory mandates.
Under the Indian DPDP Act, the legal obligation to issue such a notice is explicit and uncompromising:
- The most relevant section of the Act dealing with data breach notification is Section 8[6]. It stipulates that every organisation which determines the purpose and manner of processing personal data [a ‘Data Fiduciary’] must provide notice of personal data breaches to the Data Protection Board of India and each individual affected by the breach. This requirement applies irrespective of the organisational structure of the data fiduciary and the magnitude of the breach. Notably, there is no minimum threshold in terms of scale or number of victims: all breaches are subject to reporting under the provisions of the Act.
- Rule 7 of the Digital Personal Data Protection Rules, 2025 [notified on 14th November 2025] ensures operational application of Section 8[6]. This rule provides for a two-tier notification scheme whereby different time periods and contents of notifications are provided for notifications to the Board and to affected individuals, respectively.
Furthermore, organisations must also navigate concurrent obligations, such as reporting severe cybersecurity incidents to the Indian Computer Emergency Response Team [CERT-In] within stringent timelines [often within 6 hours of noticing the incident] under the Information Technology Act.
WHAT MUST A DATA BREACH NOTICE CONTAIN?
Considering that a Data Breach Notice is a transparent record of the incident, detailing what happened, what data was exposed, and what is being done to fix it, it must include, at a minimum, the following:
- The name and particulars of the Data Fiduciary facing the breach.
- The nature and chronology of the Personal Data breach [e.g., malware attack, insider leak, accidental exposure].
- The categories of Data Principals affected and the approximate number impacted.
- The specific categories of Personal Data compromised [e.g., financial records, health data, contact details].
- The likely consequences and risks posed to the Data Principals due to the breach.
- The technical and organisational remedial measures undertaken or proposed to mitigate the harm.
- The contact details of the Data Protection Officer [DPO] or a designated representative for further inquiries.
At the outset, it is pertinent to note that a Data Breach Notice is a time-sensitive document that requires acute precision. It must be drafted quickly but without causing undue panic or sharing unverified information. It must be accessible and clear, avoiding overly dense technical jargon when addressed to the Data Principal.
The data breach notification is not a mere paperwork exercise. Rather, it is essentially a promise made by an organisation to those individuals whose data is in its possession- a promise that should anything untoward happen to that data, the affected persons will be made fully aware of it. This commitment has now been made mandatory under the DPDP Framework. Organisations must see breach notifications as a manifestation of their responsibility, rather than paperwork to simply fulfil their obligations.
