Knowledge Resources › Data Breach Response
Last updated: 6 August 2026
A personal data breach can carry both legal and reputational consequences. Under the DPDP Act, 2023, organisations have specific obligations when a breach occurs.
General first steps
- Contain the breach — limit further access or loss of data
- Assess the scope — identify what data was affected and how many individuals are involved
- Notify — inform the Data Protection Board and affected individuals as required
- Document — keep a record of the breach and the response taken
- Review — examine how the breach occurred and address the underlying cause
Having a breach response plan in place before an incident occurs allows an organisation to act quickly and meet its obligations under the law.