Breach Readiness

Breach readiness is not a document — it is a tested capability. GDPR requires notification to the lead supervisory authority within 72 hours of becoming aware of a breach likely to risk individuals' rights (Article 33) and without undue delay to affected subjects where risk is high (Article 34). India's DPDP Rule 7 requires both without-delay intimation and a detailed 72-hour report, with no risk threshold — every breach triggers notification. CERT-In's India directions add a six-hour timeline for a cyber incident report regardless of personal-data content.

Meeting these deadlines takes rehearsal, not drafting. A ready programme has: incident classification criteria, pre-approved notification templates in every required language, pre-mapped data flows so scope can be scoped in hours, a tabletop-tested chain of command between IR / Legal / DPO / Communications, pre-filed regulator contact details, and the forensic retainer / log retention needed to produce the 72-hour report. Organisations that discover these gaps during a real breach lose their mitigation posture, which the Act directs the regulator to consider when setting a penalty.