
DPDP Act Data Breach Notification Requirements India — Complete 72-Hour Guide 2026
India’s DPDP Act 2023 and DPDP Rules 2025 Rule 7 impose a strict two-stage breach notification obligation: a preliminary alert ‘without delay’ and a detailed report to the DPBI within 72 hours, PLUS individual notifications to every affected Data Principal. No materiality threshold. Penalty up to ₹200 crore for non-compliance. This complete guide covers the dual CERT-In + DPBI obligation, what each notification must contain, and a step-by-step 72-hour incident response playbook.