Section 8(6): Mandatory Breach Notification & 72-Hour Reporting

Statutory Text (Official Gazette)

Section 8(6): In the event of a personal data breach, the Data Fiduciary shall give the Board and each affected Data Principal intimation of such breach in such form and manner as may be prescribed.

What Section 8(6) Means in Plain English

Section 8(6) requires you to report every personal data breach. Failing to notify the Board or affected users can bring a civil penalty of up to ₹200 Crore under the Schedule. It is not a criminal offence, but it is one of the largest penalties in the Act.

Whenever your company experiences a personal data breach (accidental leak, ransomware, insider exfiltration, or hacking), you must execute a two-way notification:

1. Notify the Data Protection Board of India (DPBI).
2. Notify each affected user individually.

Reporting Benchmark Under DPDP Rule 7

Under Rule 7 of the DPDP Rules 2025:

• User Alert Without Delay: Tell each affected user, through their account or registered contact, in clear and plain language: what happened and when, the likely consequences for them, what you are doing to reduce risk, what they can do to protect themselves (such as resetting passwords), and who they can contact.
• First Report to the Board Without Delay: A description of the breach, including its nature, extent, timing, location and likely impact.
• Detailed Report Within 72 Hours: Within 72 hours of becoming aware (or longer if the Board allows on written request), send:
  • Updated, detailed information on the breach.
  • The facts, circumstances and reasons that led to it.
  • Measures taken or proposed to reduce risk.
  • Any findings about who caused it.
  • Steps taken to stop it happening again.
  • A report on the alerts sent to affected users.

Incident Response Checklist for Section 8(6)

• Automated Breach Detection: Set up automated alerts for unusual bulk database exports or unauthorized administrative logins.
• Incident Response Runbook: Document an internal crisis workflow capable of drafting the 72-hour Board notification within 24 hours of detection.
• Secure User Communication Template: Prepare pre-approved notification templates in clear language for customer breach intimations.

← Back to Full Section 8: General Obligations