Intimation of personal data breach

Official Statutory Text MeitY Gazette Notified Section 40 Delegated Authority

Official Legal Text — Gazette of India

Rule 7

7. (1) On becoming aware of any personal data breach, the Data Fiduciary shall, to the best of its knowledge, intimate to each affected Data Principal, in a concise, clear and plain manner and without delay, through her user account or any mode of communication registered by her with the Data Fiduciary, ΓÇö

(a) a description of the breach, including its nature, extent and the timing of its occurrence;
(b) the consequences relevant to her, that are likely to arise from the breach;
(c) the measures implemented and being implemented by the Data Fiduciary, if any, to mitigate risk;
(d) the safety measures that she may take to protect her interests; and
(e) business contact information of a person who is able to respond on behalf of the Data Fiduciary.

(2) On becoming aware of any personal data breach, the Data Fiduciary shall intimate to the Board, ΓÇö

(a) without delay, a description of the breach, including its nature, extent, timing and location of occurrence and the likely impact;
(b) within seventy-two hours of becoming aware of the breach, or within such longer period as the Board may allow on a request made in writing in this behalf, ΓÇö
(i) updated and detailed information in respect of such description;
(ii) the broad facts related to the events, circumstances and reasons leading to the breach;
(iii) measures implemented or proposed, if any, to mitigate risk;
(iv) any findings regarding the person who caused the breach;
(v) remedial measures taken to prevent recurrence of such breach...

Plain-Language Compliance Breakdown (Editorial Analysis)

What this means: If a hack or leak happens, the company cannot cover it up.

- They must notify users "without delay" via email/app, explaining what was stolen and how the user can protect themselves (e.g., change passwords).
- They must notify the Data Protection Board immediately, and follow up with a detailed forensic report within 72 hours explaining exactly how the breach happened and who caused it.

Key Practical Takeaways for Compliance Teams

•
Delegated Specificity: This rule provides concrete operational criteria that must be reflected in technical architectures and compliance records.
•
Audit Readiness: Ensure written SOPs, consent logs, and security controls correspond directly to the statutory wording of Rule 7.
•
Statutory Traceability: In any legal interpretation, the exact Gazette text above takes precedence over internal summaries.