DPDP Act 2023 → enforcement live§8(6) + Rule 7(2): 72h breach reportMax penalty: ₹250 Cr22 scheduled languagesap-south-1 · MumbaiConsent Manager framework: pilotDPDP Rules: operationalisedDPDP Act 2023 → enforcement live§8(6) + Rule 7(2): 72h breach reportMax penalty: ₹250 Cr22 scheduled languagesap-south-1 · MumbaiConsent Manager framework: pilotDPDP Rules: operationalised
[01]Resource · 03

72 hours. Hour by hour.

When a breach happens, the §8(6) clock starts the moment you become aware. This is the hour-by-hour playbook our customers rehearse quarterly — built around the draft DPDP Rules and CERT-In Directions.

DPDP §8(6) window
72 hrs
CERT-In window
6 hrs
Roles assigned
8
Languages
22
[02]The clock

What 'in the manner prescribed' actually looks like.

[01]
T+0h
Detect & convene
SIEM/DLP alert auto-opens a war-room channel. DPO, security lead, legal, comms and exec on-call paged within 5 minutes.
[02]
T+1h
Contain
Revoke compromised credentials, rotate keys, isolate affected systems. Begin forensic snapshot.
[03]
T+6h
Scope
Query consent ledger + warehouse to enumerate affected Data Principals, purposes, sensitive categories, and cross-border exposure.
[04]
T+12h
Preliminary intimation
File preliminary breach intimation with the Data Protection Board using the auto-filled template.
[05]
T+24h
Draft Data Principal notice
Auto-generate plain-language notices in English + 22 scheduled languages. Legal review. Comms sign-off.
[06]
T+48h
Notify Data Principals
Fan out via email, SMS, WhatsApp, and in-app — only the affected, with grievance contact + remedial steps.
[07]
T+72h
File & archive
Submit full report to the DPB. Archive every artifact to the Audit Vault with cryptographic signing. Open RCA tickets.
Avg India breach cost
₹19.5 Cr
IBM 2024
Penalty (failure to notify)
₹200 Cr
Schedule
Time saved vs ad-hoc
78%
Crawlshark customers
Drill cadence
Quarterly
recommended
[03]Use case

Who needs this playbook live, not in a Google Doc.

[01]
Significant Data Fiduciaries

Mandated to maintain breach response procedures; the DPB will ask for drill evidence.

[02]
Fintech & lending

Three concurrent clocks (RBI 6h, CERT-In 6h, DPDP 72h) — only an automated runbook keeps them in sync.

[03]
Consumer apps >5M MAU

A single bug touches millions; multilingual fan-out is non-negotiable.

[04]
B2B SaaS with DPAs

Enterprise customers contractually require subprocessor breach notification within tight SLAs.

Get the editable playbook + a 30-minute tabletop drill.

We'll run a guided breach simulation with your team and hand over the customised runbook.

Book a demo See pricing