What a company must tell you after a data breach

At a glance

If a company suffers a breach involving your personal data, India’s DPDP Act requires it to tell you — the affected person — without delay and in plain language. The notice must describe what happened, the likely consequences for you, what the company is doing about it, what you can do to protect yourself, and who to contact. A vague “we take your privacy seriously” email that hides the facts doesn’t meet that bar.

Educational resource only. This explains what a business must tell affected people after a breach under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and its Rules; it is not formal legal advice.

You have a right to be told — directly

A breach of your data isn’t the company’s private problem to quietly manage — the law says you must be informed.

Under the DPDP Act, when a business suffers a personal data breach — any unauthorised access, disclosure, loss or alteration of personal data — it must notify the people affected, not just the regulator. That’s a deliberate design choice: you can’t protect yourself against a leak you don’t know about. So the notice to you isn’t a courtesy; it’s an obligation the company owes you.

The five things the notice must contain

A proper breach notice has to give you enough to actually act — not just admit something went wrong.

The DPDP Rules set out what the message to affected people must cover. Look for all five:

• What happened — a description of the breach: its nature, extent and timing.
• The consequences for you — the likely impact, so you can gauge your risk (is your Aadhaar exposed? your card? just your email?).
• What the company is doing — the mitigation measures it’s taking in response.
• What you can do — the safety measures you can take yourself to reduce your risk (for example, change a password, watch for fraud).
• Who to contact — business contact details, so you can reach a person or channel for more information.

If a notice tells you a breach occurred but leaves out the consequences or what you can do, it’s missing the parts that actually help you.

How and when they must tell you

The rule is “without delay,” in plain language, through a channel that reaches you.

Two things govern the timing and form. First, without delay — the company can’t sit on the news while it manages the fallout; you’re meant to be told promptly on the company becoming aware. (Separately, the business also has to report a detailed account to the Data Protection Board within 72 hours — but that Board deadline is not a licence to delay telling you.) Second, plain language — the notice has to be concise and clear enough for an ordinary person to understand, delivered through your account with them or another channel you’ve registered. A dense, lawyerly message that leaves you unsure whether your bank details are at risk doesn’t meet the intent.

What to do if the notice is vague or never comes

A missing or evasive breach notice is itself a failure you can escalate.

If you learn about a breach but got no notice, or the notice was so vague it told you nothing useful, you’re not without recourse:

• Ask directly. Use your right of access to ask the company what data of yours was involved and what happened.
• Push for the specifics. You’re entitled to the consequences and the safety steps — ask for them explicitly.
• Complain. Raise it with the company’s grievance officer / Data Protection Officer, then escalate to the Data Protection Board of India. Failing to notify a breach properly is exactly the kind of lapse the Board exists to address — and it carries serious penalties for the business.

FAQ