A company processing users' personal data suffers a DATA BREACH compromising the data. Under the Digital Personal Data Protection Act, 2023, the data fiduciary must:

Section 8(6) of the DPDP Act, 2023 requires a data fiduciary to notify the DATA PROTECTION BOARD and each AFFECTED DATA PRINCIPAL of any personal data BREACH, in the prescribed manner and within the prescribed time (the rules fix the specific window). This transparency obligation ensures affected individuals can take protective steps and the Board can monitor. Breach notification is a core prevention/mitigation duty of a fiduciary and is central to the Act's design. Failure attracts penalties. The notice requirement - to both the Board and the principals - is a defining accountability measure of the DPDP framework.