Personal data breach runbook

DPDP breach notices scheduled for 13 May 2027 CERT-In and sector duties may apply now

This runbook preserves one incident timeline and multiple legal decisions. “Awareness” is recorded once from facts and cannot be reset by severity or ownership changes.

First 15 minutes

• reporter records signal, time/time zone, source, system and observed facts;
• platform assigns commander/on-call and correlation ID;
• protect life/safety and contain active access where safe;
• preserve logs, alerts, configuration and volatile evidence;
• start an incident, not a conclusion; mark facts unknown rather than guessing.

First hour

• identify accountable legal entities and processor/customer chain;
• scope systems, countries, data and likely Principal populations;
• run in parallel: DPDP personal-data-breach, CERT-In listed incident, sector, contractual and law- enforcement/preservation tests;
• establish clocks, authority contacts, approvers and communication channel;
• engage counsel/DPO/communications and affected customer leads;
• prevent evidence contamination and unauthorised support/ticket disclosure.

Six-hour checkpoint

For a CERT-In-reportable incident, submit available required information within the current Direction/FAQ process; do not wait for full root cause. Store report version, submission method, receipt/attempt and update commitment. Other clocks continue independently.

DPDP initial notices

When the future DPDP provisions apply, prepare:

• each affected Principal’s clear notice: nature, extent, timing, likely consequences, mitigation, protective steps and contact;
• Board initial report without delay: nature, extent, timing/location and likely impact.

Use accessible language and specific protective action. Do not blame a vendor, speculate, or hide a material limitation. Population uncertainty is versioned.

DPDP 72-hour detail

Update/detailed Board pack includes known updates, causes/events/circumstances, mitigation, findings about the responsible person if any, recurrence prevention and Principal-notification report. If more time is needed, record the Board’s written allowance; an internal approval does not extend the clock.

Decision record

regime, source/provision, affected entity
test questions and facts
applies / does_not_apply / uncertain
awareness/trigger/deadline
decision owner and checker
report/notice versions and receipts
next update and open assumptions

Notification operation

Deduplicate recipients by tenant-approved subject route without merging separate required entity notices. Test template and channel. Send generic email/SMS alert linking to an authenticated page for sensitive detail. Reconcile delivered, bounced, unavailable and alternate-channel results. Provide assisted support scripts and fraud/phishing warning.

Processor and customer propagation

A Processor informs affected customer Fiduciaries under contract with minimum facts and update cadence. Each Fiduciary makes its own legal decision. The platform links but does not collapse those decisions or reveal another customer.

Closure

Containment and service recovery; complete destination/population reconciliation; corrective actions with owners; access/key/secret review; evidence integrity verification; customer/authority updates; lessons and control changes; two-person closure. Reopen if facts, affected population or recurrence materially changes.

Tabletop tests

• lost cloud credential with unknown access;
• misdirected email file;
• ransomware during public holiday;
• compromised connector across two customers;
• Principal notices bounce for 30%;
• Board portal unavailable;
• CERT-In incident without personal data;
• personal-data breach without a CERT-In listed incident.