Breach Notification on the DPDP Clock

The obligation to notify begins the moment a data fiduciary becomes aware of a breach, and from that point two separate clocks start running: one for the Data Protection Board, one for every data principal whose data was exposed. Both deadlines have to be met, and the fact that each notice went out has to be recorded.

ComplyIQ's incident module does not shorten that clock, and it does not watch your systems for signs of a breach. It gives the privacy team one record to log what happened, see how close the deadline is, and show — later, to the Board or in an audit — exactly when notice went out.

What the DPDP Act asks for when a breach happens

The Act and its rules place two duties on a data fiduciary that becomes aware of a personal data breach. It must intimate the Data Protection Board, and it must intimate each affected data principal, in clear and plain language, covering what happened and what to do next.

The two notices do not run on identical clocks. The Board gets an initial description without delay, then a fuller account — the specifics of what happened, what caused it, and what has been done about it — within a 72-hour window measured from the moment the organisation became aware of the breach. That 72-hour figure comes from the DPDP Rules, which are still in draft and being finalised at the time of writing, rather than from a settled number in the Act itself. It is the window as those rules prescribe it, and it is the window ComplyIQ's incident module is built around.

Logging an incident: severity, status, owner

When something is flagged as a potential breach, a privacy team opens an incident record. It is a plain register: someone names what happened, rates how serious it is, and assigns an owner to drive it to closure.

Status moves through a fixed sequence rather than a free-text field, so an open incident always sits at a known stage between detection and closure. Closed is the only terminal state, and it is the state that stops every clock attached to the record.

The 72-hour aging clock

Every open incident carries an aging indicator measured against that 72-hour window, starting from when the breach occurred or was detected. Early in the window the record reads plainly. Past the halfway mark it shades amber; further in, a deeper amber; once the window has closed, the row turns red and the label switches from a countdown to how far overdue the incident is. A closed incident stops aging — the indicator only tracks incidents that are still open.

The point of the clock is visibility. It surfaces which open incidents are approaching their notification deadline and which have already passed it, so that decision sits in a shared view rather than in one person's memory of when the breach was first logged.

The breach-notification record

Logging an incident and clearing its aging indicator are two different things. ComplyIQ keeps a separate record of the notifications themselves: one entry for data principals, one for the Board, each holding a timestamp for when notice actually went out. Until that box is checked, the record reads "not yet notified"; once it is, it reads "notified," with the date and time.

This is the artefact a privacy team would produce if the Board asked, or if an auditor wanted evidence that a specific incident's notifications went out on time. It records the fact of notification, not the deadline for it.

What the module does not do

The incident module logs and ages a breach; it does not find one. It does not scan network traffic or system logs, it does not decide how severe an incident is, and it does not draft or transmit the notification to the Board or to affected data principals. A person still has to notice the breach, judge its severity, write the notice, send it, and come back to mark it sent. What the module removes is the risk of that deadline slipping unnoticed in an email thread or a spreadsheet while the incident sits open.

The aging clock starts the moment an incident is logged as occurred or detected, and stays red until someone closes it out. See how ComplyIQ tracks a breach from log to notification: book a ComplyIQ demo.