What Is This Module For?
The Breach Notification module helps you log, assess, and report personal data breaches as required by the DPDP Act 2023.
Which Law Requires This?
- DPDP Act 2023, Section 8(6) — Every Data Fiduciary must notify the Data Protection Board and affected Data Principals of a personal data breach in the prescribed manner and time.
- DPDP Rules 2025, Rule 7 — Notification must be made promptly. Best practice is within 72 hours of becoming aware of the breach.
Penalty: Failure to notify a breach can attract penalties up to ₹200 crore under the DPDP Act Schedule.
Step-by-Step Guide
- Go to Breach Notification in the sidebar.
- Log a new breach — enter breach date/time, discovery date/time, breach type, data categories affected, estimated number of individuals, and a description.
- Assess severity — dcomply automatically flags urgent breaches involving sensitive personal data.
- Complete mandatory fields — root cause, containment measures taken, and remediation steps.
- Generate the Board Notification — click "Generate DPBI Report" to create the structured notification document.
- Notify affected individuals using the built-in notification templates.
- Close the breach once remediated and notified.
Common Mistakes to Avoid
- Waiting to confirm before logging — Log suspected breaches immediately. Update details as the investigation progresses.
- Thinking small breaches do not need reporting — Even a single record of sensitive data exposed to an unauthorised person must be assessed.
- Not notifying affected individuals — Board notification alone is not sufficient.
Frequently Asked Questions
Q: What counts as a personal data breach?
A: Any unauthorised access, disclosure, alteration, or destruction of personal data — including accidental loss of a laptop or sending data to the wrong email address.
Q: Can we report breaches verbally?
A: No. The DPDP Act requires formal written notification. dcomply generates the structured report for you.