72-Hour Breach Notification: DPDP Playbook
What Triggers a Breach Notification?
Unauthorized access to personal data causing risk to individuals:
- Financial loss
- Identity theft
- Reputational harm
- Physical harm
- Emotional distress
Note: Authorized staff access is NOT a breach.
The 72-Hour Window
Clock starts: When you discover the breach
Deadline: Within 72 hours of discovery
Hour 0-1: Confirm & Respond
- Isolate affected systems
- Stop ongoing unauthorized access
- Preserve evidence (logs, forensic data)
- Activate incident response team
Hour 1-24: Investigate
- Determine breach scope (how many users, what data)
- Identify root cause
- Quantify risk to individuals
- Engage legal/compliance team
Hour 24-48: Prepare Notification
- Draft notification message
- Include: what data breached, risk, protective steps
- Prepare FAQ for users
- Set up communication channels
Hour 48-72: Notify Affected Individuals
- Email notification
- Phone calls for high-risk cases
- Social media announcement if widespread
- Website banner
Hour 72+: Regulatory Reporting
- Report to Data Protection Board (DPB)
- File formal incident report
- Continue investigation
Documentation
Maintain records:
- Breach discovery date/time
- Notification date/time (proof of compliance)
- List of affected individuals
- Notification method
- Regulatory reports submitted
- Remediation steps
- Forensic investigation report
Disclaimer: General informational article. Consult legal/forensic experts during breach.
