Data Breach Response Plan: The First 24 Hours for Founders
A first-24-hours breach plan covering containment, evidence, legal triage, CERT-In, future DPDP notification, customers and management.
The first hours should preserve evidence and reduce harm. Blind shutdowns or speculative public statements can worsen the incident.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
Rule 7’s future process requires notices to affected people without delay and to the Board, with specified detail within seventy-two hours, once operative.
CERT-In currently requires covered entities to report specified cyber incidents within six hours of noticing or being informed.
A security incident is not automatically a personal-data breach, and a data breach can occur without malware.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
- Rule 7’s future process requires notices to affected people without delay and to the Board, with specified detail within seventy-two hours, once operative.
- CERT-In currently requires covered entities to report specified cyber incidents within six hours of noticing or being informed.
- A security incident is not automatically a personal-data breach, and a data breach can occur without malware.
- Response should coordinate technology, privacy, legal, finance, communications, support and law enforcement.
The five-point review
| Check | What to examine |
|---|---|
| Incident | What, when and detection. |
| Data | People, fields, volume and protection. |
| System | Assets, credentials and continuity. |
| Reporting | CERT-In, sector, police, Board and users. |
| Communication | Known facts and mitigation. |
Practical example
A vendor reports a customer export was publicly accessible for two days. There is no malware, but logs, affected records, access revocation and current contractual or sector duties still require immediate action.
How to apply the framework
Open an incident log using one time standard. Record decisions, evidence hashes, access changes and communications.
Use a notification matrix distinguishing current CERT-In clocks from future DPDP and sector obligations.
Operating workflow
Define the processing or incident precisely
Identify the people, data, system, purpose, owner, vendor and transaction or event. Review incident, data and system together. Do not start from a policy template or software feature; start from what the business and system actually do.
Separate current duties from future-state DPDP readiness
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative IT, CERT-In, telecom, banking, insurance, employment, consumer, contract and criminal-law requirements. Build the future DPDP process now, but do not describe a scheduled rule as already legally operative.
Preserve proof and improve the system
Keep the approved decision, notice or workflow version, access or event logs, vendor evidence, user communications and remediation record. Update product design, role access, retention, support scripts or incident playbooks so the same weakness does not recur.
Action checklist
- Activate incident command.
- Contain safely.
- Identify data and people.
- Preserve logs.
- Assess all clocks.
- Prepare affected-person support.
Evidence to keep
- Incident timeline
- Logs and images
- Impact analysis
- Reports
- Customer notices
Warning signs
- Logs overwritten
- Statement before scope known
- Vendor investigates itself
- CERT-In ignored
- No notification approval record
Finin2min takeaway
Privacy governance is an operating system, not a policy PDF. The data map, purpose, access, vendor, retention, user workflow, incident response and evidence file must all tell the same story.