Seventy-Two Hours
72 hours is the Board's deadline; your own intimation is "without delay" with no number
Read the full guide: Rule 7(2)(b) — DPDP Act compliance guide
Watch in English
Summary
Seventy-two hours is not your deadline.
72 hours is the Board's deadline; your own intimation is "without delay" with no number
Full transcript
Seventy-two hours is not your deadline.
Rule 7 runs two clocks, not one.
Yours says intimate without delay,
on becoming aware of the breach.
Pause. So where do the hours come in?
The Board's clock. Seventy-two hours.
And even that starts with without delay.
The Board gets a first description at once,
then the detail within seventy-two hours.
Two clocks. Neither of them is optional.
r.7(2)(b), r.7(1) — Digital Personal Data Protection Act, 2023 + Rules, 2025
In force from 13 May 2027