Under the DPDP Rules 2025, a school that suffers a personal-data breach must inform affected parents without delay and file a detailed report with the Data Protection Board within 72 hours. A lost laptop, a leaked WhatsApp spreadsheet or a hacked account all count. This article gives you a ready-to-adapt breach-response plan: how to detect, contain, assess, notify and document a breach so you meet the timeline and limit the damage.
What counts as a breach
The 72-hour clock: who you notify and when
- Parents (without delay) + Board (72-hour report).
The 6-step response plan
- Detect → contain → assess scope → notify parents → report to Board → document & fix.
A copy-paste parent notification template
How activity logs make all of this possible
FAQ
Q: How long do schools have to report a data breach?
A: A detailed report to the Data Protection Board within 72 hours; affected individuals must be informed without delay.
Q: Is a lost staff laptop a reportable breach?
A: If it held personal data and access can’t be ruled out, treat it as a breach and follow the plan.
Call Now
WhatsApp