DPDP Act 2023 and DPDP Rules 2025: Breach Duties for Security Teams, and When They Start

India's Digital Personal Data Protection Act, 2023 requires an organisation that decides how personal data is processed (a ‘Data Fiduciary’) to report a personal data breach to the Data Protection Board and to each affected person, under section 8(6) of the Act. That duty, the security safeguards and the penalties start 18 months after notification on 13 November 2025, so in May 2027. CERT-In's direction of 28 April 2022, with its six-hour reporting deadline for the organisations it names, has applied since 2022.

The three commencement stages

The government notified the Act's commencement and the DPDP Rules on the same day, in three stages set out in G.S.R. 843(E) and Rule 1 of the DPDP Rules, G.S.R. 846(E):

From	What applies
13 November 2025	Definitions, the Data Protection Board and its procedure (sections 1(2), 2, 18 to 26 and others; Rules 1, 2 and 17 to 21)
November 2026, one year on	Registration of Consent Managers (Rule 4, section 6(9))
May 2027, 18 months on	Notice and consent, security safeguards, breach intimation, retention, individuals' rights and penalties (sections 3 to 5, 6(1) to 6(8) and 6(10), 7 to 17, 27 except 27(1)(d), 28 to 34, 36, 37 and 44(2); Rules 3, 5 to 16, 22 and 23)

The Act received assent on 11 August 2023. Section 43A of the IT Act, on compensation for failing to protect sensitive personal data, is omitted by section 44(2) of the DPDP Act, which sits in the May 2027 stage.

What counts as a personal data breach

The definition in section 2(u) covers unauthorised processing, accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability.

Who is told, and when

Once the obligations start, Rule 7 requires a Data Fiduciary that becomes aware of a breach to inform two parties.

Each affected person, ‘without delay’, through their user account or registered contact details. The notice describes the breach, its likely consequences for them, the mitigation under way, the steps the person can take, and a contact for questions.

The Data Protection Board, also ‘without delay’, with a description of the breach: its nature, extent, timing, location and likely impact. Within 72 hours of becoming aware, Rule 7(2)(b) adds a detailed report: updated facts, the circumstances and reasons, the mitigation taken or proposed, any findings about who caused it, the remedial measures, and a report on the notices sent to individuals. Under the same Rule 7(2)(b), the Board can allow more time on a written request.

How it lines up with CERT-In

The direction that CERT-In, India's national computer emergency response team, issued on 28 April 2022 requires service providers, intermediaries, data centres, body corporates and government organisations to report the incident types in its annexure within six hours of noticing them, and to keep ICT system logs for 180 days on a rolling basis within India. Its FAQ says a first report can carry the information available at the time, with the rest sent later. Under section 38(1) the DPDP Act applies in addition to other laws, so from May 2027 one incident can fall under both:

Clock from awareness	CERT-In direction (in force)	DPDP Rules (from May 2027)
6 hours	Report to CERT-In
‘Without delay’		Description to the Board; notice to each affected person
72 hours		Detailed report to the Board

Security safeguards and log retention

Rule 6 lists the minimum ‘reasonable security safeguards’: encryption, obfuscation, masking or virtual tokens; access control; logs, monitoring and review of access; backups and continuity measures; and a clause in contracts with Data Processors (contractors processing data on the Fiduciary's behalf) requiring safeguards too.

From May 2027 two DPDP retention rules join the CERT-In one:

• Rule 6(1)(e): logs and personal data kept for one year, for detecting, investigating and remediating unauthorised access.
• Rule 8(3): personal data, traffic data and logs kept for at least one year for the purposes in the Seventh Schedule, which include lawful access by the State; the Rule's illustration applies it to Data Processors as well.
• CERT-In, in force now: the 180-day rolling log rule above.

Penalties

The Schedule to the Act sets maximum penalties imposed by the Board after an inquiry, including:

Failure	Up to
Reasonable security safeguards, section 8(5)	₹250 crore
Breach intimation to the Board or individuals, section 8(6)	₹200 crore
Children's data, section 9	₹200 crore
Duties of a Significant Data Fiduciary (one the government designates by volume or sensitivity of data), section 10	₹150 crore
Any other provision	₹50 crore

Among the factors section 33(2) requires the Board to consider is the action taken to mitigate the breach, and how timely and effective it was. The government's November 2025 backgrounder describes the Board as a four-member digital body whose decisions are appealed to TDSAT, the telecom disputes tribunal.