⏱ DPDP Data Breach Notification SOP
How Kaagazaat detects, contains, and reports personal data breaches within 72 hours under Section 8(6) of the DPDP Act, 2023.
⏱ Our 72-Hour Breach Protocol
This document describes Kaagazaat's Standard Operating Procedure for personal data breach notification under Section 8(6) of the Digital Personal Data Protection Act, 2023.
🚨 Detection (Hour 0)
Triggers that open an incident: • Automated monitoring alerts (Sentry, CloudWatch, Vercel logs) • User-reported via privacy@kaagazaat.com • Security researcher disclosure
🩺 Triage (Hour 0–4)
• Internal Incident Response Team (IRT) is activated • Severity classification: P0 (data exfiltration), P1 (PII exposure), P2 (system compromise without confirmed PII access) • Scope estimation: number of affected records, categories of data, root cause
🛑 Containment (Hour 4–24)
• Patch or isolate the breach vector • Revoke compromised credentials • Freeze affected accounts pending investigation
📣 Notification (Hour 24–72)
To the Data Protection Board of India: • Submit Form DPB-1 (or equivalent) with breach details • Channel: Data Protection Board portal (when operational) To affected Data Principals: • Email notification to last-verified email on file • In-app notification on next login • Plain-language summary of: what happened, what data was affected, what we are doing, what you should do
🔧 Remediation (Day 3–30)
• Root cause analysis published internally • Security control review • Compensation or restitution if applicable
📊 Public Report (Day 30+)
Aggregated annual transparency report published at /dpdp/transparency.
📞 Grievance Officer
Per Section 8(10) DPDP Act 2023: • Email: grievance@kaagazaat.com • Acknowledgement SLA: 48 hours • Substantive response: within 30 days
⚖️ Data Protection Board Escalation
If you are unsatisfied with our Grievance Officer's response, you may escalate to the Data Protection Board of India under Section 27 of the DPDP Act, 2023.
🛠 Report a suspected breach
If you believe a Kaagazaat user's personal data may have been exposed, write to privacy@kaagazaat.com. Include the time, the suspected scope, and any evidence. Our IRT acknowledges within 4 hours.
Effective Date: 2026-06-19 · Version 1.0