01 · How it works, in 6 steps
How does data breach notification work?
- 1
Record the moment you became aware
Note who learned what, and when, from a clock synced to NIC or NPL time. The six-hour and 72-hour periods run from awareness, and regulators will ask when it was.
- 2
Contain first
Revoke and rotate leaked access tokens and the app secret, disable compromised agent accounts, close public buckets and stop the export job — while preserving logs as evidence.
- 3
Assess scope and jurisdictions
Work out which data (numbers, names, chats, media, payment details), whose, how many people, and where they live: EU residents bring the GDPR in, Indian customers the DPDP Act.
- 4
Notify regulators in deadline order
File with CERT-In within six hours if it is a listed incident, send the DPDP intimation to the Board without delay, and notify the relevant EU authority within 72 hours where the GDPR applies.
- 5
Tell the people affected
Under the DPDP Act every affected person is told, plainly and without delay. On WhatsApp, a non-promotional utility template can carry the notice to customers you already message.
- 6
Follow up and fix the cause
Send the Board its detailed report, ask processors for their findings under your data processing agreements, and close the gap that let it happen.
02Try it
Hands-on: use the controls to work through it yourself.
Drag the clock through the first 72 hours
Time since it opened
86h 24m
86h 24m in: window closed. Past 72 hours: a late GDPR notice must give reasons for the delay.
03What is data breach notification?
Data breach notification is the legal duty to tell a regulator — and, in many cases, the people affected — when personal data has been exposed, lost, altered or accessed without authority. India's Digital Personal Data Protection Act defines a personal data breach broadly: any unauthorised processing or accidental disclosure, acquisition, sharing, use, alteration or destruction of personal data, or loss of access to it, that compromises its confidentiality, integrity or availability (section 2(u)). There is no harm threshold: a breach that touches one customer's WhatsApp chats is still a breach.
Under section 8(6) and rule 7 of the DPDP Rules 2025, the data fiduciary must tell each affected data principal without delay, in plain language: what happened and when, the likely consequences, what the business is doing about it, what the person can do to protect themselves, and who to contact. The Data Protection Board gets an intimation without delay too, followed by a detailed report — the facts and cause, mitigation, findings about who caused it, remedial steps and the notices sent to users — within the deadline the Rules set, which the Board can extend on request. Failing to notify carries a penalty of up to 200 crore rupees. These duties phase in with most DPDP obligations by 2027.
Other regimes run in parallel. The GDPR requires the controller to notify its supervisory authority within 72 hours of becoming aware of a breach unless it is unlikely to result in a risk to people (article 33), to tell the individuals without undue delay when the risk is high (article 34), and requires processors to alert the controller without undue delay. India's CERT-In Directions, in force since 2022, require listed cyber incidents — data breaches and leaks among them — to be reported within six hours. One leaked token can trigger all three. Data Retention limits how much a breach can expose; Incident Management is the operational response; notification is the legal part.
Key takeaways
- Data breach notification is the legal duty to tell a regulator, and often the affected people, that personal data was exposed, lost or misused.
- Under the DPDP Act every personal data breach is reportable: each affected person and the Data Protection Board must be told without delay.
- Under the GDPR, the supervisory authority must be told within 72 hours of awareness unless the breach is unlikely to create a risk.
- In India, CERT-In separately requires listed cyber incidents, including data breaches, to be reported within six hours.
- Failing to notify under the DPDP Act can cost up to 200 crore rupees; the duty phases in with most DPDP obligations by 2027.
04 · Key facts
Data breach notification: key facts and limits
- DPDP: affected people
- Each one, without delay (s. 8(6), rule 7)
- DPDP: the Board
- Intimation without delay, then a detailed report
- DPDP penalty for not notifying
- Up to 200 crore rupees
- GDPR: authority
- Within 72 hours of awareness (art. 33)
- GDPR: individuals
- Without undue delay if high risk (art. 34)
- CERT-In
- Listed incidents within 6 hours
- DPDP rule 7 applies from
- By 2027 (13 May 2027 on the notified schedule)
05Example: A leaked token at a Gurugram travel start-up
At 10:20 on a Monday a developer at a Gurugram travel start-up spots the company's WhatsApp system user token in a public code repository, pushed three days earlier. By 10:40 the token is revoked and rotated, and API logs show it was used from an unknown address to read about 2,300 media files — customer passport scans sent for visa bookings. The team files a CERT-In report before 16:20, sends the Data Protection Board its intimation the same afternoon, and because 140 of the customers live in France and Spain, it notifies the French and Spanish data protection authorities through its EU representative well inside 72 hours. Every affected customer receives a plain-language notice by WhatsApp utility template and email, explaining what was exposed, what the company has done and how to report misuse of their passport details.
06 · Mistakes to avoid
Common mistakes with data breach notification
Waiting for certainty before starting the clock
Deadlines run from awareness, not from the end of the investigation. Notify with what you know and send updates; a late but complete report is still late.
Applying a harm threshold the DPDP Act does not have
The GDPR lets you skip notification when risk is unlikely; the DPDP Act does not. Plan to tell every affected Indian customer and the Board for any personal data breach.
Assuming your BSP will notify for you
The business that decides how data is used — the data fiduciary — carries the duty. Your processors must tell you fast, so put a breach-notice deadline in hours into each contract.
Sending the notice as marketing
A breach notice wrapped in an apology coupon reads as spin and can be miscategorised. Keep it factual, non-promotional and focused on what the person should do.
07 · Why it matters
Why does data breach notification matter?
On a WhatsApp stack, the likely breaches are mundane: a System User Access Token committed to a public repository, an agent account taken over, an open storage bucket of media downloads, a CSV of contacts emailed to the wrong vendor. Each puts phone numbers, names and conversation content at risk, and the clocks start when you become aware, not when you finish investigating. Teams that have decided in advance who assesses, who files and what the customer message says meet the deadlines; teams that improvise spend the six-hour CERT-In window arguing about whether it counts.
08Data Breach Notification FAQs
Do I have to notify customers of every data breach under the DPDP Act?+
Who has to report a breach — my business or my BSP?+
Does a data breach have to be reported to both CERT-In and the Data Protection Board?+
What must a breach notice to affected customers contain?+
09 · Pro tips
Best practices for data breach notification
- Write the customer notice and the Board intimation as templates now, with blanks for facts.
- Keep a breach register even for incidents you decide not to report under the GDPR, with your reasoning.
- Run a tabletop exercise on a leaked WhatsApp token once a year.
- Limit how long you keep media and chat exports; what you have deleted cannot leak.