Breach & Security

← All posts
Breach & Security4 min read

The First 72 Hours After a Data Breach: A Response Plan That Works

The first 72 hours after a personal data breach decide most of your legal and reputational outcome. A working plan has a pre-assigned team, a single decision log, and parallel workstreams for containment, investigation, regulatory notices and communications. In India, that means a CERT-In report within 6 hours for specified incidents, DPDP notices to individuals and the Board without delay, and a detailed Board report within 72 hours.

Read article
Breach & Security9 min read

DPDP Breach Notification: The Rule 7 Playbook

Under Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules, every personal data breach must be reported, with no materiality threshold. You must notify each affected individual without delay, notify the Data Protection Board without delay, and file a detailed report with the Board within 72 hours of becoming aware. Many organisations must also report to CERT-In within 6 hours. Failing to notify can cost up to ₹200 crore, and inadequate security up to ₹250 crore.

Read

Get started

Get DPDP-ready, well before the deadline

See how ConsentifyAI handles consent and cookies in one place — so you can collect it properly, honour it everywhere, and prove it on demand.

Request a demo