Breach Notification & Incident Response under the DPDPA
From detection to notification: defensible timelines, evidence preservation, and multi-team coordination that stands scrutiny.
What the Law Expects
Reportable Breach
Unauthorised access, disclosure, alteration, loss, or misuse of digital personal data triggering risk to individuals.
Notification Duties
Prompt notice to the Data Protection Board of India (DPBI) and affected Data Principals in the manner and form prescribed.
Forensics & Evidence
Immediate containment, log preservation, immutable evidence storage, and third-party forensics where necessary.
Penalties & Liability
Higher penalties for failure to maintain reasonable security safeguards or to fulfill notification obligations.
Detailed Compliance Topics
Step-by-Step Incident Response
- Detect & Classify: Confirm incident scope; invoke severity matrix tied to personal data risks.
- Contain: Isolate systems, rotate secrets, disable suspect endpoints; preserve volatile data first.
- Forensics: Acquire images, collect logs, maintain chain-of-custody; avoid altering artefacts.
- Assess Harm: Identify categories/volumes of data, encryption status, likelihood of misuse.
- Notify: Prepare DPBI and Data Principal notices as prescribed; ensure clarity and support channels.
- Remediate: Patch, re-architect, revoke tokens, and harden controls; document actions.
- Post-Incident Review: Root-cause analysis, metrics, board reporting, and lessons-learnt rollout.
What the Notices Should Contain
- Summary: Nature of breach, timeframe, and affected systems/functions.
- Data Impacted: Types of personal data involved; whether protected by encryption.
- Individual Risk: Potential harms (identity theft, financial loss, profiling) and mitigation advice.
- Actions Taken: Containment steps, remediation progress, and monitoring measures.
- Support: Helpline/email, free credit/watch services (where appropriate), grievance procedure.
- Contact: DPO or incident contact in India; reference ID for tracking queries.
Preventive Controls & Readiness Checklist
- Security Baseline: MFA everywhere, least-privilege, EDR, segmented networks, immutability for backups.
- Logging & Telemetry: Centralised SIEM, retention aligned to detection needs and legal holds.
- Supplier Readiness: Contractual breach clauses (timelines, cooperation), tabletop tests with processors.
- Runbooks: Role-mapped playbooks for security, legal, PR, customer support; 24x7 on-call rota.
- Exercises: Quarterly tabletop + technical drills; metrics on MTTD/MTTR and notification cycle time.