Concept

Personal data breach

Unauthorised or accidental events that compromise the confidentiality, integrity or availability of personal data. A breach triggers intimation duties to affected people and the Board.

Official requirement · verbatim

“personal data breach” means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data

Read section 2 of the Act, where this term is defined →Rule 7 of the DPDP Rules 2025 →

Related tool

Breach Response Assistant

Turn breach obligations into a clear response workflow with the exact Rule 7 steps.

Open

DPDP data breach reporting: what Rule 7 actually requires →

Sources cited on this page

[1]The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(u), p. 3. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026