Navigating Breach Notifications: India's DPDP Act in a Global Context

The landscape of data breach notification has become a critical compliance area for businesses operating globally. With India’s Digital Personal Data Protection Act, 2023 (DPDPA) and its accompanying Rules now fully operational as of August 30, 2026, Indian entities, and those dealing with Indian personal data, must understand their obligations in comparison to established regimes like the EU’s GDPR, Singapore’s PDPA, and Australia’s Privacy Act. While the DPDPA sets a foundational framework, India’s multi-layered regulatory environment often introduces additional, stricter requirements.

India’s Evolving Framework: DPDPA and Sectoral Directives

The DPDPA, 2023, represents India’s primary legislation for personal data protection. While Section 20(7) empowers the Data Protection Board of India (DPBI) to issue directions regarding breach notification, the DPDP Rules, issued under the Act, now provide specific timelines and conditions. Under these Rules, Data Fiduciaries are generally required to notify the DPBI of a personal data breach without undue delay, and where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of Data Principals. For affected Data Principals, notification is mandated “without undue delay” if the breach is likely to result in a high risk to their rights and freedoms. This framework mirrors global best practices in its timelines and risk-based approach.

However, India’s regulatory environment extends beyond the DPDPA. Entities regulated by the Reserve Bank of India (RBI), particularly those involved in payment systems, face significantly stricter timelines. RBI circulars, such as the Cyber Security Framework in Banks and subsequent updates, often mandate reporting of cyber incidents, including data breaches, within 6 hours of detection for critical events, and 72 hours for others, directly to the RBI. Similarly, the Indian Computer Emergency Response Team (CERT-In), operating under Section 70B of the Information Technology Act, 2000, has issued directions requiring service providers, data centres, and corporate bodies to report certain cyber incidents, including data breaches, within 6 hours of becoming aware of them. These sectoral and agency-specific directives mean that many Indian businesses must navigate a compliance regime that can be considerably more stringent than the general DPDPA timelines.

EU GDPR: The Global Benchmark

The General Data Protection Regulation (GDPR) in the European Union sets a widely adopted standard for data breach notification. Article 33(1) mandates that a data controller must notify the relevant supervisory authority (e.g., a national Data Protection Authority) of a personal data breach “without undue delay and, where feasible, not later than 72 hours after becoming aware of it,” unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. This 72-hour window is a direct inspiration for many newer privacy laws, including the DPDP Rules.

For notification to data subjects, Article 34(1) of the GDPR stipulates that if a personal data breach is “likely to result in a high risk to the rights and freedoms of natural persons,” the controller must communicate the breach to the data subject “without undue delay.” This communication must describe the nature of the breach and provide specific recommendations for mitigation. The GDPR also outlines specific exceptions where data subject notification is not required, such as when the data is encrypted or measures have been taken to mitigate the high risk.

Singapore PDPA and Australia’s NDB Scheme

Singapore’s Personal Data Protection Act (PDPA), significantly amended in 2020, also incorporates mandatory data breach notification. Under Section 26C(1), organisations are required to notify the Personal Data Protection Commission (PDPC) “as soon as practicable,” and in any event no later than 3 calendar days, if the breach is likely to result in significant harm to affected individuals or is of a significant scale (affecting 500 or more individuals). This 3-day (approximately 72-hour) timeline aligns closely with GDPR and the DPDPA Rules, but with specific thresholds for notification to the regulator.

Regarding notification to individuals, Section 26D(1) of the PDPA requires organisations to notify affected individuals “as soon as practicable” if the breach is likely to result in significant harm to them. Similar to GDPR and the DPDPA, this is a risk-based assessment, focusing on the potential impact on individuals.

Australia’s Notifiable Data Breaches (NDB) scheme, part of the Privacy Act 1988 (specifically Part IIIC), mandates notification for “eligible data breaches.” An eligible data breach occurs when there are “reasonable grounds to believe” that an unauthorised access, disclosure, or loss of personal information is likely to result in serious harm to any individual. Under Section 26WK(1), organisations must notify the Office of the Australian Information Commissioner (OAIC) “as soon as practicable” after becoming aware of an eligible data breach. Similarly, Section 26WL(1) requires notification to affected individuals “as soon as practicable.” While the Australian framework does not specify an exact hourly or daily deadline, the “as soon as practicable” standard implies a high degree of urgency, with the OAIC expecting prompt action.

Comparative Overview

Comparing these frameworks, India’s DPDPA Rules align broadly with the 72-hour notification window to the regulator, similar to GDPR and Singapore’s PDPA. However, India’s sectoral regulators (RBI, CERT-In) introduce significantly stricter 6-hour timelines for specific incidents and entities, making India’s overall compliance environment potentially more demanding for regulated sectors. Australia’s “as soon as practicable” offers more flexibility in theory but demands immediate action in practice.

Regarding notification to data subjects, all jurisdictions adopt a risk-based approach, requiring notification “without undue delay” or “as soon as practicable” when there is a likelihood of significant or high harm to individuals. The DPDPA Rules, like GDPR, specify “high risk,” while Singapore uses “significant harm” and Australia uses “serious harm.” India’s DPDPA itself is less prescriptive on exact timelines, delegating specifics to the DPBI and the Rules, which allows for adaptive responses but necessitates continuous monitoring of regulatory updates.

Practical Takeaway

For Indian businesses, General Counsels, and Data Protection Officers, the key takeaway is the imperative for a robust and agile incident response plan. Compliance is not a single-layered affair; while the DPDPA Rules provide a baseline, entities must also account for potentially stricter, shorter notification periods imposed by sectoral regulators like the RBI and CERT-In. Implementing clear internal protocols for breach detection, assessment, and notification, coupled with regular training, is crucial. For companies with a global footprint, understanding the nuances of “without undue delay,” “as soon as practicable,” and specific hourly/daily deadlines across jurisdictions is vital to ensure timely and compliant reporting, mitigating both legal and reputational risks.