Dpdpa In Action Designing A 72 Hour Breach Response That Actually Works

Regulatory focus

A Nullcon panel examines India's DPDP Act Section 8 and Rule 7, requiring data fiduciaries to notify data principals and the Data Protection Board when a personal-data breach occurs.

Cyber vs privacy incidents

INOX GFL group CISO contrasts triggers: ransomware/extortion calls versus media/public leak discovery. Core assets differ (infrastructure vs personal data), impacts differ (ransom vs penalties up to hundreds of crores), and owners differ (CISO vs DPO), though roles often overlap.

Reporting lens

Cyber incidents may fall under IT Act timelines; privacy incidents invoke DPDP/GDPR-style regimes with 72-hour notification expectations.

Proactive response

JSW Paints' Neelamani Sahu urges internal breach identification before public exposure, board notification, then principal communication in plain language covering what leaked, mitigation steps, and user actions. Public discovery means failed controls and reactive damage control rather than ideal playbook execution.