Personal data breach Wider than a hack: what counts, and who must be told how quickly.
Short answer. A personal data breach is any unauthorised processing of personal data, or its accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises its confidentiality, integrity or availability. That is the definition in section 2(u) of India’s Digital Personal Data Protection Act, 2023. It is wider than a hack: ransomware that locks records is a breach, and a staff member sharing a patient’s file with an unapproved AI service can fall within it. Section 8(6) requires the data fiduciary to inform the Data Protection Board and every affected person. Rule 7 of the DPDP Rules, 2025 asks for intimation without delay and a detailed report to the Board within 72 hours. Separately, CERT-In’s 2022 directions require data breaches and leaks to be reported to CERT-In within six hours of noticing them. This is general information, not legal advice.
01
Who must be told, and when
Who
Deadline
Source
What to include
Each affected data principal
Without delay
Rule 7(1)
What happened and when, likely consequences, steps taken, steps she can take, and a contact person.
Data Protection Board, first report
Without delay
Rule 7(2)(a)
Nature, extent, timing, location and likely impact.
Data Protection Board, detailed report
Within 72 hours, or longer if the Board allows on a written request
Rule 7(2)(b)
Updated details, causes, mitigation, findings about who caused it, steps to prevent recurrence, and a report on intimations sent.
CERT-In
Within 6 hours of noticing
CERT-In directions of 28 April 2022, para (ii)
Details known at the time; CERT-In’s FAQ allows more to follow later.
02
How it differs from the GDPR
Under Article 33 of the EU GDPR, a controller notifies the supervisory authority within 72 hours where feasible, unless the breach is unlikely to result in a risk to people, and under Article 34 it tells the people affected only when the risk is high. Rule 7 of India’s DPDP Rules has no such risk threshold: it requires intimation to the Board and to each affected data principal.
03
Ways a breach happens with AI tools
A staff member uploads client or patient records to a personal AI account the office has not approved.
An AI assistant with access to a shared drive shows one user another person’s file because permissions were set too wide.
Instructions hidden in an uploaded document make an AI agent send data to an outside address (prompt injection).
Chat logs stored by a vendor are exposed, or kept longer than the contract allows.
Ransomware encrypts the server holding documents an AI system indexes, so nobody can reach them.
04
Penalties and preparation
Failing to take reasonable security safeguards can attract up to ₹250 crore, and failing to give notice of a breach up to ₹200 crore (items 1 and 2 of the Schedule). Rule 6 asks for logs and monitoring that can detect unauthorised access, kept for one year, which is also what you need to reconstruct what an AI tool saw. Rules 6 and 7 come into force eighteen months after the DPDP Rules were published in November 2025.
ANVE logs every model call on the device with the user, the app and the model, which gives an office its own trail to check after an incident. This page is general information, not legal advice. Ask a lawyer how the law applies to your office.
05
Questions people ask
Is losing access to data a breach?
Yes. Section 2(u) includes loss of access that compromises availability, so ransomware that locks records counts even if nothing is copied.
Do we report to both the Board and CERT-In?
They are separate duties. The DPDP Rules require intimation to the Board and affected people; CERT-In’s directions require listed cyber incidents, including data breaches and data leaks, to be reported to CERT-In within six hours.
What if we do not know everything within 72 hours?
Rule 7(2)(b) lets the Board allow a longer period on a written request. For CERT-In, its FAQ says entities may report what is available and add details later.
Is an employee pasting client data into ChatGPT a breach?
It can be, if it is processing the office did not authorise or a disclosure it did not intend. Whether it is depends on the facts, so treat it as an incident and assess it promptly.
06
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
