How many people’s personal data must be compromised before a company is required to report a breach under the Digital Personal Data Protection (DPDP) Act?
The law doesn’t prescribe a minimum number.
Section 8(6) requires notification of personal data breaches, while Rule 7 specifies notification to affected Data Principals and the Data Protection Board.
There is no general exemption simply because the incident affects only one individual.
For example, accidentally emailing one customer’s sensitive account information to an unauthorised recipient could constitute a personal data breach if the statutory definition is satisfied.
The circumstances must still be assessed.
The takeaway: Don’t use the number of affected individuals as the deciding factor when classifying a personal data breach.
This article is general information, not legal advice.