What Should a Business Do After a Personal Data Breach in India?

A personal data breach can create serious legal, financial and reputational consequences for a business. Personal information may be exposed through cyber attacks, stolen credentials, accidental disclosure, insider activity or weaknesses in digital systems. Once an organisation discovers a breach, it must act quickly to contain the incident, understand its impact and determine its legal obligations. India’s data protection framework is developing rapidly. The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 provide an important framework for handling digital personal data and responding to breaches. Businesses must also consider cybersecurity reporting obligations, contractual duties and sector specific regulations where applicable. A well planned response can help limit damage, protect affected individuals and demonstrate responsible data governance.

What Is a Personal Data Breach?

A personal data breach occurs when personal data is accessed, disclosed, acquired, altered, lost, destroyed or otherwise compromised without proper authorisation. A breach does not always involve a sophisticated hacking operation. It can result from a phishing attack, an employee sending confidential information to the wrong recipient, a lost laptop, weak passwords, an exposed database or incorrect cloud settings. The consequences depend on the type and volume of information involved. Exposure of names and contact details may create different risks from the disclosure of financial information, identity documents, account credentials or other sensitive personal information. Businesses should therefore assess every incident carefully instead of assuming all breaches carry the same level of risk.

What Should a Business Do Immediately After a Data Breach?

The first priority should be containment. The business should take reasonable steps to stop unauthorised access and prevent the incident from spreading. Depending on the circumstances, this may involve isolating affected systems, disabling compromised accounts, resetting credentials, restricting access and securing vulnerable applications or databases. The organisation should also preserve evidence. System logs, access records, emails, forensic information and other relevant material can help establish how the incident occurred and what information may have been compromised. Senior management should activate the organisation’s incident response procedure. IT and cybersecurity teams can investigate the technical aspects, while legal and compliance teams can assess reporting and communication requirements. The business should maintain a clear chronology from the initial discovery of the incident. The time when the organisation became aware of the breach may become important when assessing statutory and regulatory obligations.

Investigate the Nature and Scope of the Breach

Once the immediate threat has been contained, the business should determine what happened. The investigation should establish which systems were affected, what categories of personal data were involved and approximately how many individuals may have been affected. It should also examine whether the information was merely exposed or actually accessed, copied, transferred, altered or disclosed. The organisation should assess the potential consequences for affected individuals. Financial information, identity information and account credentials may create a higher risk of fraud or identity theft than less sensitive information. A breach investigation can take time. Businesses should therefore distinguish between information confirmed during the initial investigation and matters still being established. CERT In’s guidance recognises circumstances where complete information may not be available during the initial reporting period. Additional information may be submitted subsequently within a reasonable period.

Assess India’s Data Breach Reporting Requirements

A business should identify every legal and regulatory obligation triggered by the incident. The Digital Personal Data Protection Rules, 2025 contain specific requirements concerning personal data breaches. Rule 7 requires a Data Fiduciary, upon becoming aware of a personal data breach, to inform each affected Data Principal without delay. The communication should contain information concerning the nature, extent and timing of the breach. It should also explain the likely consequences, measures taken to mitigate the effects, steps individuals can take to protect themselves and relevant contact information. The Rules also require the Data Fiduciary to intimate the Data Protection Board without delay. Detailed information is generally required within 72 hours, unless the Board permits a longer period following a written request. Businesses should not interpret the 72 hour period as permission to delay their initial response. The requirement to inform without delay should be considered alongside the subsequent detailed reporting requirement.

Consider CERT In Reporting Obligations

Data protection compliance is not the only issue following a cyber incident. CERT In’s Cyber Security Directions require specified cyber incidents, including data breaches and data leaks, to be reported within six hours of noticing the incident or being brought to notice. This creates an important compliance consideration for businesses. A single incident may potentially trigger more than one reporting obligation, with different authorities and different timelines. The organisation should therefore conduct an early legal assessment rather than waiting until the technical investigation is complete.

Notify Affected Individuals Responsibly

Communication with affected individuals should be clear, accurate and practical. A notification should explain what happened, what information may have been affected and what the business has done to address the incident. It should also explain any steps individuals can take to protect themselves. For example, depending on the circumstances, affected individuals may need to change passwords, monitor financial accounts or remain alert to suspicious emails and messages. Businesses should avoid making unsupported claims. If the investigation has not established whether specific information was accessed, the notification should communicate the position accurately. A transparent approach can help affected individuals take appropriate protective measures while reducing confusion during an already difficult situation.

Review Third Party and Vendor Responsibilities

Businesses often rely on external service providers to process or store personal information. These may include cloud service providers, payment platforms, software providers, IT vendors and other technology partners. A breach involving a third party should trigger an immediate review of the contractual relationship. The business should establish when the vendor became aware of the incident, what information was affected, what containment measures were implemented and what assistance the vendor can provide with the investigation. Contracts should ideally address incident notification, security standards, cooperation, evidence preservation and allocation of responsibilities. The DPDP framework also places importance on appropriate security safeguards and contractual arrangements involving Data Processors. A business should therefore review vendor contracts after an incident and identify any weaknesses in its third party risk management process.

Preserve Evidence and Maintain Detailed Records

Documentation is an essential part of breach management. The business should record when the incident was detected, how it was investigated, what containment measures were implemented and why particular decisions were made. Records should also cover regulatory notifications, communications with affected individuals, correspondence with vendors and remediation measures. Good documentation can help demonstrate how the organisation responded to the incident. It can also assist regulators, investigators and internal teams in understanding the sequence of events. The DPDP Rules contemplate security measures designed to detect unauthorised access, investigate incidents, remediate harm and prevent recurrence. Certain logs and personal data may also need to be retained for prescribed periods for these purposes.

Assess Contractual and Commercial Consequences

A data breach can have consequences beyond privacy legislation. Businesses should review customer agreements, employment contracts, confidentiality arrangements, vendor contracts, insurance policies and other relevant documents. Some contracts may contain specific notification requirements following a security incident. Others may impose particular security standards or obligations concerning confidential information. Sector specific rules may also apply. Businesses operating in financial services, healthcare, telecommunications and other regulated sectors should consider whether additional requirements are relevant. Where the incident is significant or legally complex, obtaining advice from data breach lawyers can help the organisation assess reporting requirements, contractual obligations, regulatory exposure and communication strategy.

Address the Root Cause

Containing a breach is only the first stage of the response. The organisation should determine why the incident occurred and identify the weakness responsible for it. Remediation should address the underlying problem rather than simply restoring the affected system. Possible improvements may include stronger access controls, multi factor authentication, better password management, encryption, security monitoring, vulnerability management and employee awareness training. Businesses should also examine whether they are collecting or retaining more personal information than necessary. Data minimisation can reduce the potential consequences of future incidents. The organisation should document corrective actions and assign responsibility for implementing them.

Understand India’s Evolving Data Protection Framework

The Digital Personal Data Protection Act, 2023 is India’s principal statutory framework governing the processing of digital personal data. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 and provide further detail concerning compliance requirements, including personal data breach notifications. However, the Act and Rules contain phased commencement arrangements. Businesses should therefore check which provisions are operational at the relevant time instead of assuming every requirement applies from the same date. This is particularly important because cybersecurity obligations may apply independently of the commencement of particular data protection provisions. Businesses should maintain an up to date compliance framework and periodically review it as regulatory requirements develop.

How Can Businesses Prevent Future Data Breaches?

Effective breach prevention begins with knowing what personal information the organisation holds and where it is stored. Businesses should understand their data flows, access permissions, retention practices and relationships with third party processors. Security measures should be proportionate to the risks involved. Access should be limited to authorised personnel and systems should be monitored for unusual activity. Credentials should be protected and software vulnerabilities should be addressed promptly. Employee awareness is equally important. Staff should understand phishing risks, password security, information handling procedures and the organisation’s incident reporting process. Businesses should also conduct periodic incident response exercises. A simulated breach can reveal whether employees know who to contact, who has authority to make decisions and how regulatory and customer communications would be handled. Specialist assistance from a technology law firm may also be useful when reviewing privacy policies, technology contracts, incident response procedures and data protection compliance arrangements.

Why Businesses Need a Data Breach Response Plan

A serious data breach can require several actions at the same time. Technical teams may be investigating the incident while legal teams assess notification requirements and management considers business continuity. Without a defined response plan, these activities can become fragmented. An effective incident response framework should identify key decision makers, escalation procedures, technical contacts, legal support, reporting channels and communication responsibilities. The framework should also be tested periodically. A plan that exists only on paper may not work effectively during a genuine security incident. Regular reviews are particularly important when the organisation changes its technology infrastructure, introduces new services, works with new vendors or faces changes in India’s data protection regime.

Conclusion

A personal data breach should be treated as both a cybersecurity incident and a legal compliance matter. Businesses need to act quickly to contain the incident, preserve evidence and establish what personal information may have been affected. The next steps should include assessing applicable reporting obligations, communicating appropriately with affected individuals, reviewing third party responsibilities and documenting the response. Businesses should also identify the root cause and implement corrective measures to reduce the risk of recurrence. India’s data protection landscape is continuing to evolve. Businesses should therefore avoid treating breach management as a one time exercise. A tested incident response plan, effective security controls and clear accountability can help organisations respond more confidently when personal data is compromised. Most importantly, preparation should begin before an incident occurs. Businesses that understand their data, monitor their systems, review their vendors and regularly test their response procedures are better positioned to protect individuals and manage the legal and commercial consequences of a breach.