Short Answer
You must promptly notify the Data Protection Board and all affected users, and take immediate corrective actions to contain the breach.
In case of a breach, you must promptly notify both the Data Protection Board and all affected users, along with taking immediate corrective actions to contain the incident.
From a practical standpoint, this means you should already have a breach response plan, including detection, escalation, communication, and reporting workflows. Delays or lack of preparedness can significantly increase risk and penalties.
Law Reference
Section 8(6) – Personal Data Breach
"Notify the Board and each affected Data Principal."
Having a pre-defined breach response plan with detection, escalation, and communication workflows is critical. Delays increase both penalties and reputational damage.
An online pharmacy discovers unauthorized access to customer health data. They must immediately contain the breach, notify the Board, inform affected customers, and document all actions taken.
Was this answer helpful?
Our team is here to help you with any questions about DPDP compliance.