What to prepare before a personal data breach happens. General legal information only. Check the notification requirements in the current DPDP Rules.
Assign roles
- An incident lead who decides and coordinates
- A technical lead to contain and investigate
- A legal and communications lead for notices and statements
The first hours
- Contain the incident: isolate systems, reset credentials, stop further access.
- Preserve logs and evidence. Do not wipe devices.
- Assess what data and which people are affected.
- Record a timeline with times and decisions.
Notification
The DPDP framework requires a data fiduciary to inform the Data Protection Board and the affected individuals of a personal data breach in the manner and within the time the Rules prescribe. Other regimes may apply as well, such as CERT-In directions for cyber incidents and sector regulator rules. Identify these in advance.
After the incident
- Find and fix the cause.
- Update policies, training and vendor terms.
- Keep records of the incident and the response.
Related: Data protection (DPDP) · All data protection guides · Send an enquiry
Important disclaimer: This article is general legal information, not legal advice. It does not create a lawyer-client relationship and is not an advertisement or solicitation under Bar Council of India rules. Verify current statutes, rules and judgments before relying on it.
