Step 10 of DPDPA compliance is building your breach response and notification plan under Rule 7—you must inform both the Data Protection Board and affected individuals without delay.
Report basic breach details immediately, then submit updated facts, mitigation steps, root cause, and remedial actions within 72 hours of becoming aware.
Create a Personal Data Breach Management SOP covering what counts as a breach, internal escalation, triage, notification templates, and reporting to users and the Board.
Penalties are steep: ₹250 crore for failing to implement security safeguards and ₹200 crore for failing to notify a breach