Short answer: From 13 May 2027, an app that suffers a personal data breach must tell each affected user without delay and send the Data Protection Board an initial report without delay, followed by a detailed report within 72 hours of becoming aware (s.8(6), Rule 7). There is no materiality threshold in the text, and failure to notify carries a penalty of up to ₹200 crore.
What is a personal data breach under the DPDP Act?
A personal data breach is any unauthorised processing of personal data, or any accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to it, that compromises its confidentiality, integrity or availability (s.2(u)).
- Interpretation: because the definition includes loss of access, an incident such as a ransomware lock-out may be a breach even if no data leaves the app.
- Data handled by the app's Data Processors matters too, because the app is responsible for processing carried out on its behalf (s.8(1)).
Who must be notified, and when?
An app must notify two audiences: each affected user, without delay, through her user account or registered communication mode; and the Board, first without delay with an initial description, then within 72 hours with detailed information (Rule 7(1), (2)).
Breach timeline at a glance
| When | To whom | What to include | Source |
|---|---|---|---|
| Without delay | Each affected user | Nature, extent and timing; likely consequences; mitigation; safety steps the user can take; business contact information | Rule 7(1) |
| Without delay | Data Protection Board | Initial description: nature, extent, timing, location, likely impact | Rule 7(2)(a) |
| Within 72 hours of becoming aware (or longer if the Board allows on written request) | Data Protection Board | Updated detailed information; facts and reasons; mitigation; findings on the person responsible; remedial measures; report on intimations to users | Rule 7(2)(b) |
| Within 6 hours (separate law) | CERT-In | Specified cyber incidents under the CERT-In Directions, 2022 | CERT-In Directions |
The CERT-In row is context only. The CERT-In Directions are made under the IT Act and already apply to specified cyber incidents.
What must the user notice say?
The notice to each affected user must be concise, clear and plain, and sent through her user account or registered mode of communication (Rule 7(1)). It must cover:
- the nature, extent and timing of the breach
- its likely consequences for her
- the mitigation measures taken or being taken
- the safety measures she can take
- business contact information of a person able to answer her questions
Is there a threshold below which a breach need not be reported?
No threshold appears in the text. The duty attaches to any personal data breach, and neither the Act nor the Rules contain a materiality or harm test (Rule 7).
- Interpretation: this is commonly read as requiring notification of every breach, including minor ones. No Board guidance has been issued to narrow it.
- In its Lok Sabha answer of 12 August 2026, MeitY gave no count of breach intimations. Rule 7 itself starts on 13 May 2027.
What is the penalty for failing to notify?
Failure to notify the Board or affected users of a personal data breach carries a penalty of up to ₹200 crore (Schedule item 2). This is separate from the penalty of up to ₹250 crore for failing to take reasonable security safeguards (Schedule item 1), so a single incident can engage both. See the penalties page.
What this means for your app
These are practical steps teams commonly consider. They are not a guarantee of compliance.
- Consider a written breach runbook that starts the 72-hour clock from the moment the team becomes aware, with named owners for the Board report and user notices.
- A common approach is to pre-draft templates for the Rule 7(1) user notice and the Rule 7(2) Board reports, with fields for each required item.
- Make sure you can reach affected users through their account or registered email or phone, and can identify who was affected.
- Consider contract terms requiring SDK vendors, cloud providers and other processors to tell you promptly about breaches affecting your users. See processors and SDKs.
- Align the runbook with the separate 6-hour CERT-In reporting duty.
- Keep logs for at least one year so you can establish the nature, extent and timing of an incident (Rule 6(1)(e)). See security safeguards.
- Run a tabletop exercise before 13 May 2027 and record it in your readiness checklist.