Rule 7 — DPDP Rules, 2025
(1) In the event of a personal data breach, a Data Fiduciary shall give intimation of such breach to the Board immediately upon becoming aware of such breach, in such form and manner as may be specified. (2) The intimation under sub-rule (1) shall contain— (a) the nature and scope of the breach; (b) the personal data affected by the breach; (c) the likely consequences of the breach; (d) measures taken or proposed to address the breach. (3) A Data Fiduciary shall also give intimation of the breach to each Data Principal whose personal data has been affected, in such form and manner as may be specified. (4) The Board may, after considering the nature and scope of the breach, direct the Data Fiduciary to take such additional measures as it may consider appropriate.
Source: Digital Personal Data Protection Rules, 2025. Official text available at truconsent.io/resources/dpdp-rules.pdf.
Rule 7 creates a two-step notification obligation, not a single '72-hour deadline'. Step 1: immediate Board disclosure upon becoming aware of a breach — with a prescribed form covering nature, scope, affected data, likely consequences, and remedial measures. Step 2: notification to each affected Data Principal. Neither step has a grace period to assess whether the breach is 'significant enough' to notify — the obligation triggers on awareness of the breach, not on a severity determination. The Board can then direct additional measures after reviewing the notification.
A fintech company discovers at 9am that its customer database was accessed unauthorised overnight. The instinct is to spend 24-48 hours investigating before deciding whether to notify. Rule 7 does not permit this. 'Immediately upon becoming aware' means the Board notification must go as soon as the breach is confirmed — not after root cause analysis is complete. The notification can be updated with additional information later, but the initial intimation must go immediately.
Rule 7(2) specifies four mandatory elements: nature and scope (what happened, which systems were affected), personal data affected (which categories, how many Data Principals), likely consequences (what harm could result), and measures taken or proposed (what you are doing to contain and remediate). A one-line 'we have had a security incident' notification does not satisfy Rule 7.
Every Data Principal whose data was affected must be notified — not a statistical sample, not just those where harm is 'certain'. If 100,000 customer records were accessed, all 100,000 must be notified. The Board will specify the form and manner, but it will need to include at minimum what data was affected and what the Data Principal should do to protect themselves.
A SaaS vendor (Data Processor) suffers a breach that exposes a retail company's (Data Fiduciary's) customer data. The SaaS vendor must notify the retail company. The retail company must then notify the Board and its customers under Rule 7. The retail company cannot outsource the notification obligation to the vendor.