Keep every personal data breach in one register, from detection to closure. The DPDP Rules require affected Data Principals and the Board to be told without delay and a detailed report to the Board within 72 hours. ComplyIQ starts the clock at detection and keeps it in front of the team until everyone who must be told has been. DiscoverIQ scopes the data involved, and ConsultIQ drafts the notices.
DPDP Breach Notification Challenges
Under the DPDP Rules, a personal data breach must be reported without delay to each affected Data Principal and to the Data Protection Board, followed by a detailed report to the Board within 72 hours. Once a breach is detected, the team has to establish what happened, which data and which people are affected, which vendors are involved, and who must be told.
Incident notes scattered across chat threads and email make the timeline hard to reconstruct, and the deadline is easy to lose track of.
No single register
Breaches are recorded in chat threads and email, with no shared timeline.
Deadlines out of sight
There is no record of when the Board's report is due or who has already been told.
Scope unknown
The team cannot quickly say which data and which Data Principals are affected.
Vendor breaches
When a Data Processor is breached, the link to its contract and assessment is missing.
DPDP Breach Notification with IQWorks
Your team today
Breaches recorded in chat and email
With IQWorks
One breach register
ComplyIQ records when each incident occurred, was detected and was reported, with its severity, status, the number of affected Data Principals and the vendor involved.
Your team today
A deadline no one tracks
With IQWorks
The Board's 72-hour window tracked
The Board's detailed report is due within 72 hours and must report on the notices sent to Data Principals. ComplyIQ runs the clock from detection until the Board and every affected Data Principal have been told.
Your team today
Notices written from scratch under pressure
With IQWorks
Notices drafted from a template
ConsultIQ's breach notification template drafts notices to the regulator and to affected individuals, tailored to your organization.
Your team today
The data involved is unclear
With IQWorks
Scope from your discovery results
Filter DiscoverIQ findings by department, data type and file name to scope the affected data, and link each incident to the vendor involved.
See it working on your own data
A live walkthrough against your regulations and your systems.
Request DemoProducts for DPDP Breach Notification
Privacy Compliance, Simplified
- A register of personal data breaches with severity, status, affected count, assignee and vendor
- Occurred, detected and reported times on every incident
- A 72-hour clock on every breach, running until the Board and affected Data Principals are told
- A posture score that shows whether breach controls are met
AI Privacy Consultant
- A breach notification template for notices to the regulator and to affected individuals
- Drafts tailored to your organization
Know Your Data
- Findings filterable by department, data type and file name
- Values masked from anyone not authorized to see them
DPDP Breach Notification Workflow
Log the breach
Record when the incident occurred, was detected and was reported, with its severity and the vendor involved.
Log the breach
Record when the incident occurred, was detected and was reported, with its severity and the vendor involved.
Scope the impact
Use DiscoverIQ to find the affected data, and record how many Data Principals are affected.
Scope the impact
Use DiscoverIQ to find the affected data, and record how many Data Principals are affected.
Watch the 72-hour window
The clock runs from detection until the Board and affected Data Principals have been told.
Watch the 72-hour window
The clock runs from detection until the Board and affected Data Principals have been told.
Draft the notices
Draft notices to the regulator and affected individuals from ConsultIQ's breach notification template.
Draft the notices
Draft notices to the regulator and affected individuals from ConsultIQ's breach notification template.
Close with a full record
Close the incident with its timeline, notifications and vendor link kept in the register.
Close with a full record
Close the incident with its timeline, notifications and vendor link kept in the register.
Key Takeaways
- One register for every personal data breach
- The Board's 72-hour deadline tracked, with both notices on record
- Vendor breaches linked to the vendor's record
DPDP Breach Notification FAQ
Each affected Data Principal and the Data Protection Board, without delay, followed by a detailed report to the Board within 72 hours.
From the moment your team identifies an incident: logging it, scoping the data, tracking the 72-hour deadline and drafting the notices.
DPDP Breach Notification Resources
Regulations
Guides
Data Breach Response Plan Guide
Create and implement a comprehensive data breach response plan that meets regulatory notification requirements.
Free Tools
Estimate breach cost by industry and size
Indicative DPDP Act penalty exposure from a website
Glossary
Data breach notification is the legal requirement for organizations to inform supervisory authorities and affected individuals when a security incident results in unauthorized access to, or loss of, personal data.
A Data Protection Board is a regulatory body established to oversee and enforce data protection laws, such as the Data Protection Board of India under the DPDP Act or the European Data Protection Board under the GDPR.
Articles
Breach Notification on the DPDP Clock
India's DPDP Act puts breach notification on a tight clock. How ComplyIQ's incident module tracks the 72-hour window and who was notified when.
Other Solutions
Notices, consent, children's data, rights requests and breaches for the DPDP Act, on one inventory.
One posture score, clear owners and due dates, and records that stay current.