DPDP has no materiality threshold for breach notification, and that changes what "minor incident" means

A small team notices a misconfigured bucket exposed forty customer records for a few hours, catches it fast, and decides it's too minor to report. Under GDPR that call might hold up. Under DPDP, as drafted, it doesn't. There is no size below which a personal data breach falls outside the reporting duty.

Where the duty comes from

Section 8(6) of the Act requires a Data Fiduciary to give intimation of a personal data breach to the Board and to each affected Data Principal. Rule 7 fills in how, and it opens the same way for both audiences: "On becoming aware of any personal data breach." Not on becoming aware of a serious one. Not above a certain number of records. Any.

What has to reach the affected person, and how fast

Rule 7(1) sets the standard for the person whose data was exposed. The intimation has to be concise, clear, and in plain language, delivered without delay through her user account or whatever mode of communication she has registered with you.

Five things go into that message: a description of the breach covering its nature, extent, and timing; the consequences relevant to her that are likely to follow; the mitigation measures you've implemented or are implementing; the safety steps she can take herself; and the business contact information of someone able to actually respond to her questions. That last item matters more than it looks. A no-reply notification satisfies nothing here.

What has to reach the Board, in two stages

The Board gets a different structure. Rule 7(2)(a) requires an initial report without delay, covering the breach's nature, extent, timing, location of occurrence, and its likely impact. That's the fast, rough picture, sent before you've finished investigating.