Personal data breach

Under section 2(u) of the Digital Personal Data Protection Act, 2023, a personal data breach is any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to it, that compromises its confidentiality, integrity or availability.

Rule 7 of the Digital Personal Data Protection Rules, 2025 sets two duties on two clocks from 13 May 2027. The data fiduciary must tell each affected data principal without undue delay, and must tell the Board, first without undue delay and then with fuller particulars within seventy-two hours of receipt of information of the breach. The seventy-two hours runs from receipt of information, not from the breach or the end of an investigation, and an extension has to be given by the Board in writing. The position is stated as at 13 November 2025.