Data Breach at a Small Business: The DPDP 72-Hour Plan

What counts as a personal data breach?

The Act defines a personal data breach broadly: unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability.

That covers deliberate attacks and simple mistakes alike. A stolen phone with customer chats, an email with salary details sent to the wrong address, a misconfigured cloud folder and a ransomware attack that locks the billing system are all breaches.

There is no minimum size. A breach affecting one person still triggers intimation, although the facts will shape what you say and what steps you take.

What does Rule 7 require?

Affected Data Principals must be intimated without delay, through their user account or the communication method they gave you. The message should describe the breach, its nature, extent, timing and location, the likely consequences, the steps you are taking to mitigate risk, the safety measures they can take, and a contact who can answer their questions.

The Data Protection Board must be intimated without delay with a description of the breach. Within 72 hours of becoming aware, or a longer period if the Board allows on request, you must send a detailed report covering updated facts, the circumstances and reasons, mitigation measures, any findings about who caused it, remedial steps to prevent recurrence and a report on the intimations given to affected people.

Failing to intimate a breach is one of the highest penalty heads in the Schedule to the Act, separate from any penalty for the security failure that caused it.

How does the CERT-In six-hour rule fit in?

CERT-In’s directions of 28 April 2022, issued under section 70B of the Information Technology Act, require service providers, intermediaries, data centres, body corporates and government organisations to report specified cyber incidents to CERT-In within six hours of noticing them. These include data breaches, data leaks, ransomware and unauthorised access to systems.

The CERT-In report and the DPDP intimation are separate obligations with different recipients and content. A breach caused by a cyber incident will often need both.

Build both into the same plan so the person handling the incident does not have to work out the rules under pressure.

Preparing before anything happens

Write a one-page breach plan that names who decides, who investigates, who contacts affected people, who files with the Board and CERT-In, and who speaks to customers or the press. Keep phone numbers of your IT provider, key vendors and insurer on the same page.

Make sure vendors will tell you quickly. Your data processing agreements should require prompt notice of incidents, because the 72-hour clock runs from when you become aware.

Keep logs. Rule 6 expects access logs to be maintained, and they are the evidence you will need to establish what happened, how far it went and when.

The first 72 hours

1. Contain (hour 0)

   Disconnect affected devices, reset passwords, revoke access, recall misdirected emails where possible and preserve logs and evidence.

2. Assess (first few hours)

   Establish what data, whose data, how many people and how it happened. Record decisions and times.

3. Report cyber incidents to CERT-In (within 6 hours)

   Where the incident is one specified in CERT-In’s directions, report it within six hours of noticing it.

4. Intimate the Board and affected people (without delay)

   Send the initial intimation to the Data Protection Board and plain-language notices to affected individuals with steps they can take.

5. Investigate and remediate (hours 6–72)

   Confirm the cause, fix the weakness, check vendors involved and document mitigation.

6. File the detailed report (within 72 hours)

   Send the Board the detailed report: updated facts, reasons, mitigation, findings, remedial measures and intimations given.