DPDP breach response plan template for NGOs (72 hours)

From 13 May 2027, if personal data you hold is breached, the DPDP Rules, 2025 require you to inform each affected person and the Data Protection Board without delay, then send the Board a detailed report within 72 hours of becoming aware (Rule 7). There is no minimum size. One stolen phone holding a WhatsApp group of beneficiaries can count. This template is item T4 on our DPDP Rules 2025 compliance checklist for NGOs.

What counts as a breach

The Act defines a personal data breach broadly: any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability. In nonprofit life that includes:

• a field phone or laptop lost or stolen with beneficiary data on it;
• a Google Sheet shared as “anyone with the link”;
• a former staff member who still has access to the CRM;
• a vendor reporting a hack on their side;
• ransomware locking your MIS so you can’t reach records.

Before anything happens: four things to set up

1. Roles. An incident lead (usually your data protection lead), an IT contact, a communications lead, and your lawyer’s number. Write down a deputy for each.
2. A breach log. Even incidents you decide aren’t reportable get an entry: what happened, when you found out, what you decided, and why.
3. Contact routes for affected people. Rule 7 says to reach them through their user account or the contact details you hold. If you have no phone numbers for a group, decide now how you’d reach them, for example through facilitators.
4. Vendor clauses. Your contracts with processors should require them to tell you quickly, because the 72 hours run from when you become aware.

The 72-hour plan

Hour 0–2: contain and log

• Write down the time you became aware. The clock starts here.
• Stop the leak: revoke the link, wipe the device remotely, reset passwords, cut off the vendor’s access.
• Don’t delete evidence. Take screenshots and keep the logs (you should be keeping logs for a year anyway under Rule 6).

Hour 2–12: assess

• What data? Names and phone numbers are serious; health, financial, ID documents or children’s data are more serious.
• Whose, and how many? Programme, location, count.
• What could happen to them? Calls from fraudsters, stigma, safety risks for survivors of violence.

Without delay: initial intimations

• To the Board: a description of the breach, including its nature, extent, timing and location, and its likely impact.
• To each affected person: in clear, plain language, (a) what happened, when and how much; (b) the likely consequences for them; (c) what you are doing about it; (d) what they can do to protect themselves; and (e) who to contact at your organisation.

By hour 72: the detailed report to the Board Rule 7(2) asks for:

1. updated, detailed information on the description above;
2. the broad facts about the events, circumstances and reasons behind the breach;
3. measures implemented or proposed to reduce the risk;
4. any findings about who caused it;
5. remedial steps to prevent it happening again;
6. a report on the intimations you sent to affected people.

If you can’t finish in 72 hours, the Board may allow more time on a written request. Make the request before the deadline, not after it.

Worked example: a stolen field phone

Illustrative scenario. On a Tuesday evening a field coordinator’s phone is stolen at a bus stand. It holds a WhatsApp group with 340 women from a livelihoods programme, with photos of ration cards some had sent during enrolment.

• 20:10 Coordinator calls the incident lead. Time of awareness logged.
• 20:30 IT wipes the phone remotely and removes the number from the WhatsApp group via another admin.
• Wednesday 10:00 Assessment: names, phone numbers and ration card images for about 120 of the 340. Likely risk: fraud calls, misuse of ration card details.
• Wednesday 13:00 Initial note to the Board. Facilitators begin calling the 340 women using the script below; SMS for those not reached.
• Thursday Root cause: enrolment over WhatsApp, no device lock policy. Fix: enrolment moves to the app, ration card photos are no longer collected, and devices get a mandatory screen lock.
• Friday 18:00 Detailed report filed, about 70 hours after awareness.

Sample message to affected people (read aloud or SMS, in the local language):

“This is [Organisation]. On [date] a phone belonging to our staff was stolen. It had your name and phone number, and for some of you a photo of your ration card. We have wiped the phone remotely. You may get calls from people pretending to be from us or a government office. We will never ask you for an OTP or money. If anyone does, hang up and call us on [number]. You can also call this number with any questions.”

After the incident

Close the loop in your breach log, and update the data inventory and the retention schedule. Most breaches we see trace back to data that didn’t need to be collected or kept. Our plain-language consent notice samples help you collect less from the start. The same discipline applies to the operational systems themselves; see how we think about access and roles in Zoho One for nonprofits.

Next step

A breach plan only works if you know where your data is. Book your ZolaShield assessment → for a full data map, a scored risk report and a 180-day plan in two weeks.