{"slug":"india-dpdp-security-and-breach-notification","id":"AIPT-OBL-0050","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0050","title":"Implement reasonable security safeguards and notify breaches","short_title":"Security and breach notification","category":"incident_handling","summary":"Data Fiduciaries must protect personal data with reasonable security safeguards and, on a personal data breach, inform the Data Protection Board and each affected individual in the form and manner prescribed by the Rules.\n","practical_action":"Extend incident response to cover AI training data and model outputs that reveal personal data.","is_binding":true,"applies_from":null,"section":null,"source_reference":"Section 8(5) and 8(6); DPDP Rules on breach intimation","official_source_url":"https://www.meity.gov.in/data-protection-framework","review_status":"verified","confidence_level":"medium","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","actors":["provider","deployer"],"sectors":["cross_sector"],"use_cases":["health","generative_ai"],"applicability":[{"description":"All Data Fiduciaries.","actors":["provider","deployer"],"conditions":null}],"evidence_examples":[{"title":"Breach notification procedure","description":null,"artifact_type":"document"}],"framework_mappings":[{"framework":"iso_27001","framework_name":"ISO/IEC 27001:2022","reference":"Annex A incident management controls","note":"Original editorial mapping.","confidence_level":"medium","is_original":true}],"controls":[{"slug":"accuracy-robustness-security-testing","title":"Accuracy, robustness, fairness and security testing","kind":"technical","relationship":"supports","note":"Reasonable security safeguards evidenced by testing.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/accuracy-robustness-security-testing"},{"slug":"privacy-and-data-protection-for-ai","title":"Privacy and data-protection controls for AI","kind":"process","relationship":"supports","note":"Breach handling extended to model outputs and training data.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/privacy-and-data-protection-for-ai"},{"slug":"ai-incident-management-and-reporting","title":"AI incident management and regulatory reporting","kind":"process","relationship":"satisfies","note":"Breach notification to the Board and individuals within the incident process.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/ai-incident-management-and-reporting"}],"url":"https://aipolicytracker.org/obligations/india-dpdp-security-and-breach-notification","policy":{"slug":"india-dpdp-act","title":"Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025","status":"partially_applicable","jurisdiction":"india","url":"https://aipolicytracker.org/policies/india-dpdp-act"}}