The Worst Time to Design an Incident Process Is During an Incident
When a personal-data breach occurs, technical teams need answers quickly.
What happened?
When did it happen?
Which systems were affected?
Whose information was involved?
How was access obtained?
What has been contained?
Could it happen again?
These answers depend on preparation long before the incident.
What the DPDP Rules Require
Under Rule 7, once the relevant provisions commence, the framework requires affected Data Principals to be informed without delay and requires intimation to the Data Protection Board. Updated detailed information to the Board is prescribed within 72 hours of becoming aware of the breach, subject to any longer period allowed by the Board on written request. MeitY
As of 5 October 2026, this provision is part of the group scheduled to commence eighteen months after the Rules' 13 November 2025 publication. Organisations should therefore use the remaining implementation period to build operational readiness rather than wait for commencement. MeitY
Seventy-Two Hours Is an Operational Challenge
A legal team cannot produce meaningful breach information unless technology teams can reconstruct what happened.
That requires security telemetry.
Identity logs.
Endpoint logs.
Firewall events.
Cloud activity.
Application logs.
Database activity.
Asset inventories.
Incident-management workflows.
Logs Must Be Useful, Not Merely Collected
Thousands of devices generating millions of logs do not automatically create visibility.
Logs need centralisation, correlation, retention, time synchronisation, alerting and investigation capability.
A SOC or SIEM architecture can help convert events into evidence.
Know Your Data Before the Breach
Incident response becomes significantly harder when the organisation does not know which systems contain personal information.
Data discovery and classification should therefore be connected to breach-response planning.
Backups Are Part of Cyber Resilience
If ransomware affects systems containing personal data, response involves both security investigation and business recovery.
Backups should be protected, monitored and tested for restoration—not simply assumed to work.
Conduct a DPDP Breach Simulation
Organisations should test a scenario before facing the real event.
Can the security team detect it?
Can IT identify affected systems?
Can privacy and legal teams receive the necessary evidence?
Can leadership understand business impact?
Can recovery teams restore services?
Can the organisation demonstrate what corrective actions were taken?
A simulation converts a theoretical incident-response document into operational evidence.
Don't discover your DPDP response gaps during a breach.
Ask Data Confiance for a security, logging, backup and breach-readiness assessment.