Ask most compliance teams how long they have to report a data breach under India's DPDP Act, and you'll get the same answer: 72 hours. It's not wrong, exactly. It's incomplete in a way that could cost an organisation a chunk of a ₹200 crore penalty ceiling.

The 72-hour window in Rule 7 of the Digital Personal Data Protection Rules, 2025 applies to one specific piece of a two-track, two-stage notification process, and it's not the piece most people assume.

Two Recipients, Different Clocks

Under Section 8(6) of the DPDP Act, a Data Fiduciary that becomes aware of a personal data breach owes notification to two separate parties: the Data Protection Board of India, and every affected Data Principal. Rule 7 governs how each of those notifications has to work, and it does not treat them identically.

The Data Principal notification runs on a standard called "without delay." There's no numeric grace period attached to it. Rule 7(1) requires a description of the breach, the likely consequences for that specific person, mitigation steps taken, protective actions they can take themselves, and contact details for follow-up, sent as soon as reasonably possible after the organisation becomes aware.

The Board notification is where the two-stage structure actually lives. Rule 7(2)(a) requires an initial, brief intimation, again "without delay", covering the nature, extent, timing, location, and likely impact of the breach. Only the second stage, Rule 7(2)(b), carries the 72-hour figure: a detailed, updated report covering root causes, mitigation measures, findings on responsibility, remedial steps, and a summary of what was sent to affected individuals.

So the 72-hour number that gets repeated as the headline compliance fact is actually the deadline for the second half of one of two notification tracks. The first alert to the Board, and the entire notification to affected individuals, are both subject to the stricter "without delay" standard.

Why the Distinction Actually Matters

Treating 72 hours as the universal deadline creates a specific, predictable failure mode: organisations build an incident response plan with a three-day buffer built in, then discover during an actual breach that "without delay" was never on that buffer.

There's a real-world pattern here worth naming, drawn from how incident response commonly breaks down rather than from any single case: security teams confirm a breach, escalate internally, and legal or compliance functions start drafting a response, comfortable in the belief that they have three days. Meanwhile, the Data Principal notification and the Board's initial alert, both of which are supposed to move immediately, sit in a drafting queue behind the 72-hour deliverable. By the time anyone checks the actual rule text, the "without delay" obligations are already late, even though the 72-hour deadline technically hasn't passed yet.

The Bigger Miscalibration: No Materiality Threshold

The 72-hour confusion sits alongside a second, arguably larger one. Organisations with GDPR experience tend to import a habit: assess the breach's severity first, and notify individuals only if the risk crosses a meaningful threshold. The DPDP Act doesn't offer that judgment call. There's no statutory mechanism for deciding a breach is too minor to notify. If the incident meets the Act's definition of a personal data breach, unauthorised processing, or accidental disclosure, acquisition, alteration, destruction, or loss of access, both notifications are owed, regardless of scale.

Encryption doesn't change this either. It's good practice and genuinely reduces harm to affected individuals, but it isn't a recognised exemption from the notification duty itself.

What This Means Operationally

None of Rule 7 is enforceable yet in the strictest sense; it sits in the DPDP Rules' third commencement phase, effective 13 May 2027. But the underlying duty in Section 8(6) of the Act exists independently, and building the operational capability to meet "without delay" standards isn't something that compresses well under pressure.

The organisations likely to handle this cleanly when enforcement begins are the ones treating "without delay" as the harder, more urgent deadline it actually is, with 72 hours reserved specifically for the one detailed report it actually governs. See how RuleExpert helps businesses manage DPDP better.

#breachnotification#data#databreach#dpdp#ruleexpert