The statutory definition is broader than a cyberattack but narrower than every mistake. Here is exactly what triggers it, and what it costs to get wrong.
August 2026 · 6 min read
The Digital Personal Data Protection Act, 2023 gives "personal data breach" a specific statutory meaning under Section 2(u). It is wider than most people assume — it is not limited to hacking — but it is not unlimited either. Getting the boundary right matters, because the notification and penalty obligations that follow only switch on once that boundary is crossed.
The Act defines a personal data breach as any unauthorised processing of personal data, or any accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability. Every clause in that definition is doing work, and it is worth taking apart piece by piece.
Nothing in the definition requires a hacker, a ransomware incident, or a large-scale leak. It covers two distinct categories instead: unauthorised processing on one hand, and accidental events on the other. If personal data is exposed, altered, destroyed, or accessed without authorisation — and that compromises confidentiality, integrity or availability — the statutory threshold is met, regardless of whether anyone broke in from outside.
"Unauthorised processing" means processing not permitted under the Act, and the definition does not restrict this to outside actors — internal misuse counts just as much as an external intrusion. But this limb still needs both elements present at once: the processing has to be unauthorised, and it has to actually compromise confidentiality, integrity or availability. Unauthorised processing that causes no such compromise does not, on its own, meet the statutory bar.
Separately, the definition expressly covers accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access. Where an accidental event of this kind compromises confidentiality, integrity or availability, it qualifies as a personal data breach in its own right — the statute names these events specifically rather than leaving them to be inferred.
Confidentiality, integrity and availability are the three security attributes the Act names explicitly, and a breach requires a compromise of at least one of them. The Act does not define the three terms further, but treats them as the operative legal threshold — meaning the analysis in any given incident comes down to which of these three was actually affected, not just whether something unusual happened.
Because the definition turns on compromise, not every irregularity counts. Processing that is authorised under the Act does not become a breach just because something went wrong procedurally elsewhere. An event that does not compromise confidentiality, integrity or availability does not qualify, even if it looks alarming on its face. And where there was neither an unauthorised event nor an accidental one, there is no breach to speak of. The statute is focused on actual compromise — not on procedural irregularity for its own sake.
Section 8(6) requires a Data Fiduciary to give intimation of a breach both to the Board and to each affected Data Principal, in the form and manner prescribed. Rule 7 of the DPDP Rules, 2025 fills in the specifics: affected Data Principals have to be intimated without delay, and the Board has to be intimated without delay as well, followed by a detailed report within seventy-two hours — or a longer period if the Board allows one. None of this is discretionary once the statutory definition is met; notification is mandatory.
Section 8(5) separately requires a Data Fiduciary to maintain reasonable security safeguards to prevent a breach from happening in the first place. Failing to meet that obligation carries its own penalty exposure under the Schedule to the Act, independent of whether an actual breach occurs — a breach of the safeguards obligation can attract a penalty of up to ₹250 crore, and a failure to give proper breach notice can attract a penalty of up to ₹200 crore. These penalties are imposed under Section 33, where the Board determines the breach in question to be significant.
Under Indian law, a personal data breach is an unauthorised processing event or an accidental event affecting personal data that compromises its confidentiality, integrity or availability — both the triggering event and the resulting compromise have to be present together. Not every mistake rises to that level. But wherever compromise does occur within the meaning of Section 2(u), the full statutory breach framework — notification duties, penalty exposure, and Board scrutiny — applies in full.
Knowing what counts as a breach is only useful if you can act on it — our breach readiness assessment checks whether your organisation actually could, today.
30 minutes to talk through your specific data footprint — no obligation.
Book a Consultation