Statutory notification deadlines leave zero room for improvisation
Under Rule 7 of the DPDP Rules, a Data Fiduciary must intimate the Data Protection Board of India (DPBI) and every affected Data Principal without delay, followed by a detailed report within 72 hours of becoming aware of a personal data breach. Furthermore, under CERT-In Directions, cybersecurity incidents must be reported to CERT-In within 6 hours of notice.
When an incident occurs, attempting to establish notification thresholds, write customer communications, and coordinate forensics on the fly leads to panicked omissions and severe penalties. We build your response playbooks in advance.
Core components of our breach preparedness programme
-
Incident Severity Classification Matrix
Objective criteria to classify events from minor technical alerts to confirmed personal data breaches requiring regulatory notification.
-
Statutory Notification Playbooks & Templates
Pre-approved communication templates for the Data Protection Board of India, CERT-In, enterprise customers, and affected data principals.
-
Digital Evidence Preservation Protocols
Procedures for engineering teams to capture memory dumps, snapshot cloud volumes, and lock firewall logs without contaminating forensic integrity.
-
Executive Tabletop Breach Simulation
A facilitated 3-hour tabletop exercise simulating a realistic ransomware, API data exfiltration, or rogue vendor scenario to test leadership readiness.