After a data leak, it is important to first limit the harm, identify the information affected and preserve evidence. Applicable notification obligations must be checked in light of the organisation, the incident and the law in force at the relevant time.
Understand the Law and the Process
A leak of names and email addresses, the exposure of payment credentials and the public disclosure of medical records do not carry the same risks. Customers should find out what data was affected, how long it was at risk and what steps the organisation has taken. For a business, concealing an incident and merely fixing the server may not be an adequate response. The main DPDP breach-notification obligations are linked to phased commencement; at the same time, applicable CERT-In directions and banking or other sector-specific rules may already be relevant. It would be incorrect to say that one deadline applies to every business and every incident. Customers should also not be told that they are automatically entitled to a fixed amount of compensation.
Further Details: What Could Affect the Outcome?
Record a suspected leak separately from a confirmed leak. The incident log should note the detection time, affected systems, containment measures and who was notified, and when. Deleting logs in the name of an investigation or sharing a customer’s full identity in an open group could make the problem worse. Even for a small business, it is useful to clearly assign responsibility for the technical investigation and legal reporting to different individuals.
What Should You Do?
- Customers should change their passwords and check active sessions and payment alerts; businesses should restrict affected access.
- Preserve the complete incident record and check whether reporting and customer notification are required under the applicable rules.
- If there are actual signs of fraud, notify the relevant bank, platform and cybercrime complaint channel.
Which Documents Should You Keep?
Keep the leak notice, transaction alerts, incident timeline, access logs and the organisation’s written responses.
Hypothetical Example
Imagine that a clinic’s appointment list, which also included diagnoses, became accessible. Taking the website offline may be the first step, but a separate assessment will still be needed to determine which patients were affected and whom to notify.
Is There One Reporting Deadline for Every Data Breach?
No. The correct deadline must be determined by considering the organisation concerned, the sector, the nature of the incident and the applicable notifications.
Sources and Related Rules
- Digital Personal Data Protection Act 2023
- DPDP commencement notification, November 2025
- DPDP Rules 2025
- National Cybercrime Reporting Portal — Official FAQ
Editorial review: 26 October 2026. This is general legal information. The outcome may vary depending on the facts of the matter, applicable state law and subsequent amendments.