Breach-ready in practice: beyond the policy document

Plenty of organizations have a breach-notification policy. Far fewer are actually ready — able to detect a breach, contain it, and notify the right people in time, calmly, on a bad day. The gap between the document and the drill is where things go wrong.

What the DPDP Act expects

If a personal data breach occurs, you must notify the Data Protection Board of India and the affected Data Principals, in the manner and timelines the Rules specify. Getting this wrong carries penalties up to ₹200 crore — second only to the security-failure penalty itself. (See penalties.)

Why a policy alone fails

A policy says what should happen. Under pressure, teams need to know exactly who does what, with which tools, in what order. Without that, you get delay, confusion, and missed deadlines — precisely what the Board penalizes.

What real readiness looks like

1. Detection you can trust

You can't report what you can't see. Monitoring, alerting, and audit logs (built here) turn "we think something happened" into "here's what happened, when, and to whom."

2. A runbook, not a policy

A step-by-step runbook: roles, decision tree, communication templates for the Board and affected users, and a clock. Everyone knows their job before the incident, not during it.

3. A tested drill

Run a tabletop exercise. The first time your team walks the process should not be a real breach. Drills surface the gaps — a missing contact, an unclear owner, a slow approval — while they're cheap to fix.

4. Evidence of good faith

When the Board assesses a breach, your response and mitigation count. A documented, tested process is evidence you took your duties seriously — which materially affects the outcome.

Make it ongoing

Breach readiness decays as your systems change. Keeping it current is part of Managed Compliance, including periodic drills.

Not sure how ready you are? Start with the free DPDP Quick Scan.

General information, not legal advice.