DPDP has no materiality threshold for breach notification, and that changes what "minor incident" means
Need help with dpdp? We can handle it for you.
A small team notices a misconfigured bucket exposed forty customer records for a few hours, catches it fast, and decides it's too minor to report. Under GDPR that call might hold up. Under DPDP, as drafted, it doesn't. There is no size below which a personal data breach falls outside the reporting duty.
Where the duty comes from
Section 8(6) of the Act requires a Data Fiduciary to give intimation of a personal data breach to the Board and to each affected Data Principal. Rule 7 fills in how, and it opens the same way for both audiences: "On becoming aware of any personal data breach." Not on becoming aware of a serious one. Not above a certain number of records. Any.
What has to reach the affected person, and how fast
Rule 7(1) sets the standard for the person whose data was exposed. The intimation has to be concise, clear, and in plain language, delivered without delay through her user account or whatever mode of communication she has registered with you.
The Data Fiduciary shall, to the best of its knowledge, intimate to each affected Data Principal, in a concise, clear and plain manner and without delay, through her user account or any mode of communication registered by her with the Data Fiduciary...
Five things go into that message: a description of the breach covering its nature, extent, and timing; the consequences relevant to her that are likely to follow; the mitigation measures you've implemented or are implementing; the safety steps she can take herself; and the business contact information of someone able to actually respond to her questions. That last item matters more than it looks. A no-reply notification satisfies nothing here.
What has to reach the Board, in two stages
The Board gets a different structure. Rule 7(2)(a) requires an initial report without delay, covering the breach's nature, extent, timing, location of occurrence, and its likely impact. That's the fast, rough picture, sent before you've finished investigating.
From the blog
Prefer to skip the paperwork?
BuildWright can take this off your plate — done properly, the first time.
Get new templates and compliance updates by email.