DPDP Act & Rules 2025: Breach Detection & 72-Hour Notification

TL;DR — India's Digital Personal Data Protection (DPDP) Rules, 2025 were notified in November 2025, operationalising the DPDP Act, 2023. The obligation that reshapes security operations: on discovering a personal data breach, a Data Fiduciary must notify the Data Protection Board (and affected individuals) — with breach reporting expected within a 72-hour window. You cannot report a breach you never detected, which makes continuous monitoring a de-facto DPDP requirement, not just a security nicety. Penalties run up to ₹250 crore.

The DPDP Act spent two years as principle without procedure. That changed when the Rules were notified in late 2025: the operational obligations — on consent, security safeguards, cross-border transfer and, critically, breach notification — are now live. For a CISO, the breach-notification clock is the requirement that lands hardest on the SOC.

The obligation that changes security operations

"Reasonable security safeguards" has teeth now

The Act requires Data Fiduciaries to implement reasonable security safeguards to prevent breaches. With the Rules notified and a digital Data Protection Board able to take online complaints, that once-vague phrase is now enforceable — and penalties reach ₹250 crore. A demonstrable detection-and-response capability is the clearest evidence that safeguards are real.

What a Data Fiduciary needs operationally

Frequently asked questions

Does the DPDP Act explicitly require a SIEM or SOC?

Not by name — it requires "reasonable security safeguards" and breach notification. But a 72-hour notification obligation is unworkable without monitoring that detects breaches quickly, so a SOC is the practical means of compliance. Sectoral regulators (RBI, IRDAI) are more explicit.

Who is a "Data Fiduciary"?

Broadly, any entity that determines the purpose and means of processing personal data — most organisations handling customer or employee data in India. Significant Data Fiduciaries face additional obligations.

How does DPDP interact with the DLP we already run?

Directly — DLP reduces the chance and scope of a reportable breach. See our BFSI DLP compliance guide for how data controls and monitoring reinforce each other.

Preparing for the DPDP Rules 2025? Talk to our SOC engineers about breach-detection monitoring that makes the 72-hour clock achievable, with data kept in India and flat per-asset pricing.

This article is general information, not legal advice — validate your specific DPDP obligations with qualified counsel.