What to do in the first hour of a suspected personal data breach

The first hour of a suspected breach is usually untidy. One employee has a screenshot, another has changed a password and nobody knows whether the exposed file contains ten customers or ten thousand. The immediate objective is to reduce further harm and establish reliable facts while the reporting assessment begins.

This is a suggested response sequence, not a statutory sixty-minute deadline. As of 22 October 2026, the main DPDP breach duties are scheduled for 13 May 2027 under the commencement notification. Existing obligations, including applicable CERT-In reporting, must be considered now.

Name a coordinator and open a record

Choose one person to coordinate the response and a second to record events. In a very small team, the same person may temporarily perform both roles, but important decisions should still be documented.

Record when the issue was noticed, who reported it, what system is involved and what is currently known. Separate observations from assumptions. “The link opened without signing in” is an observation. “Nobody outside the company saw it” needs evidence.

Use a restricted working location for the incident record. Avoid creating a new broadly shared spreadsheet containing all affected personal data merely to discuss the first exposure.

Contain the route without destroying the story

If a public link is exposing a file, restrict the link through an authorised administrator. If an account appears compromised, use the organisation’s approved process to limit access. Contact the supplier when it controls the relevant system.

Preserve useful evidence such as the original alert, relevant access settings, logs and the timing of changes. Containment and preservation need coordination: indiscriminately deleting files or wiping a device can make it harder to understand what happened. Where specialist help is needed, involve it promptly.

Do not wait for certainty about the full population before taking a proportionate containment step. Equally, avoid uncoordinated changes that disrupt essential services without improving control of the incident.

Ask what personal data and consequences are involved

The Act’s section 2(u) defines a personal data breach through specified unauthorised or accidental processing events that compromise confidentiality, integrity or availability. A suspected breach is therefore not limited to a confirmed external hack.

A hypothetical clinic might discover that a receptionist accidentally replaced appointment records with an older file. The immediate concern includes integrity and access to reliable information, even if nobody has proved that an outsider copied anything. The team needs to investigate the actual event rather than use “no data stolen” as the end of the discussion.

Identify the affected system, likely data categories, approximate population, relevant time window and any particularly consequential uses. Keep uncertain estimates labelled as such. A number can be updated; an unsupported confident statement is harder to explain later.

Start the reporting assessment in parallel

The CERT-In Directions of 28 April 2022 require covered entities to report specified cyber incidents within six hours of noticing them or being brought to notice. Whether the organisation and incident are covered needs prompt assessment. The official FAQ explains that available information can be reported initially, with additional information supplied later within a reasonable time.

Do not postpone that assessment until a full forensic report arrives. Identify the reporting contact, retain the submission record and track follow-up questions. Sector-specific and contractual notices may also require examination.

For future DPDP readiness, Rule 7 distinguishes information to affected individuals without delay, initial information to the Board without delay and a detailed Board update within seventy-two hours of awareness, or a longer period allowed by the Board on a written request. That seventy-two-hour stage is not a general permission to wait before the first notification.

End the hour with a controlled handover

List what has been contained, what remains exposed, which facts are unresolved and who owns each next action. Establish when the team will reconvene. A supplier investigation without a named internal owner can stall while everyone waits for the next email.

Prepare a factual holding message if people need immediate protective information, but avoid speculation about causes, complete safety or final impact. Approval should be fast enough to support the relevant obligations and the needs of affected people.

The first hour has succeeded when the organisation has reduced avoidable exposure, preserved useful evidence, assigned decisions and started the correct reporting process. It has not necessarily established the cause or completed every notification. Those later tasks need the reliable record created at the start.