Compliance & labour law · Updated October 2026
Data breach notification under the DPDP Act is the duty of a Data Fiduciary to tell both the Data Protection Board and every affected person when personal data is breached. Section 8(6) of the Act creates the duty, and Rule 7 of the DPDP Rules, 2025 sets the content and timing; neither applies until the scheduled start date of 13 May 2027.
Section 2(u) defines a personal data breach broadly: any unauthorised processing, or accidental disclosure, sharing, alteration, destruction or loss of access that compromises the confidentiality, integrity or availability of personal data. Unlike Europe’s GDPR, there is no “unlikely to cause harm” exception. Everyday HR examples include:
| To whom | When | What it must cover |
|---|---|---|
| Each affected employee or candidate | Without delay, through their user account or registered contact channel | Nature, extent and timing of the breach, likely consequences, mitigation steps, what they can do to protect themselves, a contact person |
| Data Protection Board, first intimation | Without delay | Description, nature, extent, timing, location and likely impact |
| Data Protection Board, detailed report | Within 72 hours of becoming aware, or longer if the Board allows on a written request | Updated facts, cause, mitigation, who caused it if known, steps to prevent a repeat, and a report on notices sent to individuals |
Picture this: a payroll executive discovers on Monday at 10 am that the outsourced processor’s shared folder holding 1,200 payslips was public. The first Board intimation and the employee notices go out the same day; the detailed report is due by Thursday 10 am. The clock runs from when you become aware, and the Act holds you responsible even though the vendor caused it, so your payroll outsourcing contract needs a vendor-to-you reporting window well inside 72 hours.
Penalties under the Schedule run up to Rs 200 crore for failing to notify and up to Rs 250 crore for failing to take reasonable security safeguards that would have prevented the breach.
Yes, separately: the CERT-In directions of April 2022 under the IT Act already require reporting specified cyber incidents, including data leaks, within six hours, so a ransomware attack on your HR systems is reportable today even before the DPDP duty starts.
Under Rule 7 there is no minimum number or harm threshold, so plan to notify each affected Data Principal and the Board for small incidents too.
A written incident plan naming who decides and who drafts notices, current personal email or phone contacts for ex-employees, and access logs from your systems; role-based access control also shrinks how much any single leak can expose.
Breaches of fingerprint or face data are the hardest to contain, so read how biometric attendance systems store templates before your next device purchase.