How quickly must a personal data breach be reported under the DPDP Act?

Unlike some data protection regimes that scale notification obligations to the severity or scope of a breach, the DPDP Act's notification requirement applies regardless of how significant the breach appears at first assessment — any personal data breach triggers a reporting obligation to the Board and to affected individuals. This makes the speed and clarity of a company's internal breach-detection and escalation process the determining factor in whether it can actually meet the notification window, not just having a policy on paper.

Practical compliance means having a documented incident response plan that specifies who is notified internally when a suspected breach is detected, a pre-approved template and process for notifying the Data Protection Board and affected individuals, and a clear chain of responsibility so the clock starting on 'becoming aware' of a breach doesn't get lost in internal escalation delays. Companies processing India personal data through vendors or processors should also ensure their vendor contracts obligate the vendor to notify the company promptly of any breach on the vendor's side, since the Data Fiduciary's notification obligation to the Board doesn't pause while it waits to hear from a processor.