Rule 7 — Intimation of Personal Data Breach

Rule 7 is the operational detail behind Section 8(6) of the Act, which simply says a Data Fiduciary must notify the Board and affected Data Principals "in such form and manner as may be prescribed." Rule 7 is that prescription. It splits into two separate notification duties — one to affected individuals, one to the Board — and the duty to the Board itself splits again into an immediate step and a detailed follow-up. Most summaries collapse all of this into "72 hours," which misses the part that actually happens first.

Step one: notify affected Data Principals — without delay

On becoming aware of a breach, the Data Fiduciary must intimate each affected Data Principal "to the best of its knowledge," in a concise, clear and plain manner, and without delay — through her registered user account or whatever mode of communication she has on file. Rule 7(1) specifies five things that notice has to cover:

• A description of the breach — its nature, extent, and when it occurred
• The consequences relevant to her, likely to arise from it
• The mitigation measures the Fiduciary has implemented or is implementing
• The safety measures she can take herself to protect her interests
• Business contact information for someone able to respond to her questions

There's no numeric deadline attached to this step — "without delay" is the standard, which in practice means as soon as the facts needed to write a plain-language notice are known, not once a full investigation has concluded.

Step two: the Board gets notified twice

Rule 7(2) requires the Data Fiduciary to intimate the Board on becoming aware of a breach, and it splits that into two sub-steps:

Immediately, without delay: a description of the breach's nature, extent, timing and location of occurrence, plus its likely impact — an initial alert, not a finished analysis.

Within 72 hours of becoming aware (or a longer period the Board permits on a written request): a fuller follow-up report covering updated and detailed information on that same description, the broader facts and circumstances behind the breach, mitigation measures implemented or proposed, any findings on who caused it, the remedial steps taken to prevent recurrence, and a report on what was actually communicated to affected Data Principals.

So the 72-hour clock governs the detailed follow-up report specifically. The first alert to the Board, and the first notice to affected individuals, are both due immediately — "without delay" — not held back until the 72-hour mark.

Why this matters in practice

The practical failure mode Rule 7 creates isn't missing the 72-hour report — most incident response plans are built around some version of that number already. It's treating "72 hours" as the whole obligation and only starting to draft anything once that clock is running, which means the "without delay" notices to affected individuals and the Board's initial alert arrive late, or don't get sent as a distinct step at all. A breach-response plan that only has one notification template, timed to a 72-hour deadline, is missing half of what Rule 7 actually requires.

This also means the trigger for both obligations is the same moment: when the organisation becomes aware of the breach, not when it decides the breach is "serious enough" to report. Rule 7 doesn't build in a severity threshold — any personal data breach as defined in Section 2(u) of the Act starts both clocks.

Illustration: a SaaS company discovers on a Tuesday morning that a misconfigured database exposed customer email addresses and order history overnight. By Tuesday afternoon, it should have sent affected customers a plain-language notice covering what happened and what to do, and given the Board an initial description of the breach's nature and likely impact. By Friday morning — 72 hours from discovery — it owes the Board a full follow-up: root cause, who's responsible if known, remedial steps taken, and confirmation of what customers were told.

How Rule 7 connects to the rest of the Rules and the Act

Rule 7 exists to operationalise Section 8(6) of the Act, which states the breach-notification duty in general terms. Rule 6's security safeguards are the preventive counterpart — the measures a Data Fiduciary should already have in place to reduce how often Rule 7 gets triggered at all. Rule 8's retention timelines interact with breach scope indirectly: data retained longer than necessary is data that can be exposed in a breach that otherwise wouldn't have existed. And on the enforcement side, a mishandled breach notification is squarely within what Section 33's penalty framework — up to ₹250 crore under the Schedule — is built to address, with the seven factors in Section 33(2) (including how quickly mitigation steps were taken) deciding where within that ceiling a penalty actually lands.