The First 72 Hours After a Data Breach: A Response Plan That Works

Who this is for: CISOs, security operations leads, DPOs and legal counsel who will run the response when a breach happens.

Breaches rarely start with certainty. They start with an odd alert, a customer complaint, a researcher's email or a ransom note. What happens in the next three days decides most of the outcome: how much data is lost, how regulators view your conduct, how customers react, and, under the DPDP Act, how large any penalty is. Section 33(2) explicitly requires the Data Protection Board to weigh the timeliness and effectiveness of your mitigation.

This is the operational companion to our Rule 7 breach notification playbook, which explains the legal requirements. Here we focus on running the response, hour by hour.

Before the breach: what must already exist

You cannot write a plan during an incident. These must be in place beforehand:

• A named team with deputies: incident lead, security and forensics, DPO, legal, communications, customer support and an executive decision-maker
• Severity criteria: what makes an incident a personal data breach, and who is called in at each level
• A data map: which systems hold which personal data, about whom (see ROPA under DPDP)
• Pre-approved templates: CERT-In report, DPDP initial intimation to the Board, the 72-hour report, and notices to affected individuals
• Vendor contacts: breach contacts and contractual notification duties for critical vendors (see vendor risk under DPDP)
• Out-of-band communications: a way to coordinate if email or chat is compromised
• External support on retainer: forensics, outside counsel and, if needed, crisis communications

The decision log

Open a single, timestamped decision log the moment an incident is declared. Record every material fact, decision, action and notification, with who made it and when. The log serves three purposes:

1. It anchors the awareness time, from which the DPDP deadlines run.
2. It provides most of the content for the 72-hour Board report, which must include the events, circumstances, mitigation and notifications made.
3. It is your best evidence of timely and effective mitigation if the Board later considers a penalty.

Hours 0 to 6: contain and decide

The most important decision in this window is the personal data assessment. Do not delay it in the hope of certainty. The DPDP Act has no materiality threshold, so if personal data is affected, Rule 7 applies.

Hours 6 to 24: scope and notify

Notices to individuals should not wait for the full investigation. Send what you know, in plain language, and update if facts change.

Hours 24 to 48: understand and remediate

Hours 48 to 72: report

By the 72-hour mark, the detailed report must reach the Board, unless the Board has allowed longer on a written request. Under Rule 7(2)(b), it must include:

1. updated and detailed information on the breach
2. the broad facts of the events, circumstances and reasons leading to it
3. measures implemented or proposed to mitigate risk
4. any findings about the person who caused it
5. remedial measures taken to prevent recurrence
6. a report on the notifications given to affected individuals

Have legal counsel review the report for accuracy and consistency with what was told to CERT-In, sector regulators and individuals.

After 72 hours

• Complete remediation and confirm the attacker has been removed
• Update the Board if material facts change
• Run a post-incident review within two weeks, covering what worked, what failed and what changes
• Update the plan, the ROPA, vendor contracts and controls
• Report to the board of directors

Common response failures

• Waiting for certainty before deciding personal data is affected. It delays every deadline that follows.
• No single decision log. Different teams keep different records, and the report cannot be reconciled.
• Evidence destroyed during containment. Rebuilding systems before preserving logs makes the root cause impossible to prove.
• Inconsistent accounts. CERT-In, the Board, regulators and customers hear different versions of the facts.
• Forgetting customer support. Customers who receive a notice will call. Agents without a script make it worse.

Response plan checklist

How ConsentifyAI helps

When an incident is declared, ConsentifyAI gives your response team the data context it needs: affected systems are linked to your Record of Processing Activities, so you can quickly identify affected data categories, individuals and vendors. Each notification is tracked against its deadline, and every action is recorded with a timestamp in a tamper-evident audit trail that becomes the backbone of your 72-hour report.