Skip to main content

The 3rd and main DPDP commencement date is computed as 13 May 2027, which is interpretation until officially confirmed.

dpdprules.org
Data breached?
☰

Sources last verified on 9 October 2026. Methodology

Concept

Personal data breach

Unauthorised or accidental events that compromise the confidentiality, integrity or availability of personal data. The definition is in force. The duty to tell affected people and the Board, under section 8(6) and Rule 7, commences on 13 May 2027, a date computed from the notification, so treat it as interpretation until officially confirmed.

Official requirement · verbatim

“personal data breach” means any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data

Read section 2 of the Act, where this term is defined →Rule 7 of the DPDP Rules 2025 →

What the definition covers

Plain English

The definition has 2 limbs. The first is any unauthorised processing of personal data. The second is accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data. The definition closes with the words that compromises the confidentiality, integrity or availability of personal data. The definition has been in force since 13 November 2025 and imposes no duty on its own.

Interpretation requires judgment

The closing words of the definition are best read as qualifying both limbs, so an event is a personal data breach when it compromises the confidentiality, integrity or availability of personal data. Beyond that, neither the definition nor the intimation duty in section 8(6) carries a size, harm or likelihood of harm threshold, so an incident that only makes data unavailable, with nothing disclosed, can still be a personal data breach through loss of access and availability. Section 8(6) applies in the event of a personal data breach, Rule 7 applies on becoming aware of any personal data breach, and Rule 7 asks for a description of the breach and its likely consequences or impact rather than setting a threshold for whether to report. Section 8(6) and Rule 7 commence on 13 May 2027, a date computed from the commencement notification, so treat it as interpretation until officially confirmed.

Plain English

2 duties of the Data Fiduciary are built on the term. Section 8(5) requires reasonable security safeguards to prevent a personal data breach, including for processing done on its behalf by a Data Processor. Section 8(6) requires intimation of a breach to the Board and to each affected Data Principal, and Rule 7 sets the manner. Each affected Data Principal is told, to the best of the Data Fiduciary's knowledge, in a concise, clear and plain manner and without delay, through her user account or a registered mode of communication: a description of the breach, the consequences likely to arise for her, any mitigation measures, the safety measures she may take, and business contact information of a person who can respond to her queries. The Board is told without delay with a description of the breach and its likely impact, and then, within 72 hours of the Data Fiduciary becoming aware of the breach or a longer period the Board allows on a written request, receives updated and detailed information, including the facts leading to the breach, mitigation and remedial measures, any findings on who caused it and a report on the intimations given to Data Principals. Section 8 and Rule 7 commence on 13 May 2027, a date computed from the commencement notification, so treat it as interpretation until officially confirmed.

Plain English

The 2 duties carry different penalties and survive the exemptions differently. Under the Schedule, a breach of the section 8(5) safeguards duty may attract a penalty extending to 250 crore rupees, and a failure to give notice under section 8(6) a penalty extending to 200 crore rupees. Section 17(1) switches off most of Chapter II in the cases it lists, but it expressly keeps sections 8(1) and 8(5), so in those cases the safeguards duty still applies while the section 8(6) intimation duty does not. That carve back is limited to section 17(1): section 17(2) disapplies the whole Act, including section 8(5), for processing by a State instrumentality the Central Government notifies in the interests of sovereignty and integrity of India, security of the State and the other grounds it lists, and for processing for research, archiving or statistical purposes that meets its conditions, and section 17(5) lets the Central Government, within 5 years of commencement, declare that any provision does not apply to notified Data Fiduciaries for a specified period. On an intimation the Board may direct urgent remedial or mitigation measures and inquire under section 27(1)(a), and a Data Principal may complain to it about a personal data breach under section 27(1)(b). Sections 8, 17, 27 except section 27(1)(d), and 33 commence on 13 May 2027, a date computed from the commencement notification, so treat it as interpretation until officially confirmed.

Related tool

Data Breach Response Playbook

Rule 7 is not in force yet, so plan its breach steps now, including the detailed submission to the Board within 72 hours unless it allows longer on a written request, against the exact requirements.

Open

Articles that use this term

Sources cited on this page

  1. [1]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(u), p. 3. Published 11 August 2023. Official source ↗ · Official requirement · Verified 17 August 2026In force since 13 November 2025
  2. [2]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(u), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
  3. [3]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(u), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
  4. [4]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(u), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
  5. [5]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (a), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Document status: published; in effect per its own terms
  6. [6]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 2(u), p. 3. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
  7. [7]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(6), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  8. [8]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (1), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  9. [9]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (1), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  10. [10]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (2), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  11. [11]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Document status: published; in effect per its own terms
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026
  12. [12]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 1, (4), p. 24. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026In force since 13 November 2025
    Also cited on this page · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026
  13. [13]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(5), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  14. [14]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 8(6), p. 7. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  15. [15]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (1), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  16. [16]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (1), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  17. [17]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (1)(e), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  18. [18]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (2)(a), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  19. [19]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (2), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  20. [20]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (2)(b), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  21. [21]
    Digital Personal Data Protection Rules, 2025 (English section of Gazette No. 760) (G.S.R. 846(E)), r. 7, (2)(b), p. 26. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  22. [22]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), The Schedule, p. 21. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  23. [23]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), The Schedule, p. 21. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  24. [24]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), The Schedule, p. 21. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  25. [25]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), The Schedule, p. 21. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  26. [26]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(1), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  27. [27]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  28. [28]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2)(a), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  29. [29]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2)(a), p. 11. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  30. [30]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(2)(b), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  31. [31]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 17(5), p. 12. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Not yet in force; the computed date is 13 May 2027, which is interpretation until officially confirmed
  32. [32]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 27(1)(a), p. 14. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Phased commencement; it commences in 2 parts: clause (d) of sub section (1) on the computed date 13 November 2026, which is interpretation until officially confirmed, then the rest on the computed date 13 May 2027, which is interpretation until officially confirmed
  33. [33]
    The Digital Personal Data Protection Act, 2023 (Gazette print hosted by MeitY) (Act No. 22 of 2023), s. 27(1)(b), p. 14. Published 11 August 2023. Official source ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Phased commencement; it commences in 2 parts: clause (d) of sub section (1) on the computed date 13 November 2026, which is interpretation until officially confirmed, then the rest on the computed date 13 May 2027, which is interpretation until officially confirmed
  34. [34]
    Commencement notification for the Digital Personal Data Protection Act, 2023 (G.S.R. 843(E)), (c), p. 2. Published 13 November 2025. Official source ↗ Also on MeitY (byte identical) ↗ · The source's own words, quoted; not a requirement of the DPDP framework · Verified 3 October 2026Document status: published; in effect per its own terms