Run a Breach Tabletop Exercise Before May 2027

From 13 May 2027, a personal data breach will owe a notice to every affected person and to the Data Protection Board of India (the Board), followed by a detailed report within 72 hours. That sits on top of the six-hour report to the Indian Computer Emergency Response Team (CERT-In) that most businesses already owe. The first time your team runs those clocks together should not be a real incident. A tabletop exercise, a scripted incident talked through around a table with no systems touched, shows in 90 minutes where the plan breaks. Trayambic's whitepaper "One Incident, Many Clocks" sets out the full framework; this is the drill.

Who sits at the table

Keep it to about eight people, each able to decide for their function:

• the incident lead (CISO or head of IT);
• the privacy contact published under Rule 9 of the DPDP Rules, 2025, or the DPO;
• legal counsel;
• a senior executive who can approve spending and public statements;
• the heads of customer support and communications;
• the owner of the vendor relationship in the scenario;
• a facilitator, who reads the injects and holds back the next one until the room decides;
• a scribe, who timestamps every decision.

Invite the vendor only if its contract allows a joint drill.

The script

Illustrative scenario: an online test-preparation company with about three lakh learners, a quarter of them under 18. A software vendor runs its customer-support desk. Allow 10 minutes for the briefing, about 12 for each inject and 20 for the debrief.

No Board members had been appointed by August 2026, and we have found no published form or channel for breach intimations, so draft into your own template.

The decisions to test

1. 1.Is it a breach? Section 2(u) of the DPDP Act covers any accidental disclosure that compromises the confidentiality of personal data. In our view the researcher's access was already a disclosure to someone unauthorised, so the room should not wait for proof of misuse.
2. 2.Who must be told? Under Rule 7, the Board and each affected person, without delay, however few. For learners under 18 the data principal, the person the data is about, includes the parent (s.2(j)), so in our view the notice goes to the parent. CERT-In runs separately: six hours from noticing or being told, which here means the researcher's email. Regulated businesses add their sector clocks from the whitepaper's master table.
3. 3.What do individuals hear? Rule 7(1) requires what happened and when, the likely consequences, what you have done, what they can do and a contact. ID cards invite impersonation, so warn of callers quoting enrolment details and asking for OTPs. Send it through the registered channel, with no links.
4. 4.When was vendor notice due? Only the data fiduciary, the business deciding how data is used, owes Rule 7 notices, and in our view its clock runs from its own awareness. But s.8(1) keeps it answerable for vendors processing on its behalf, so a contract allowing 72 hours is too slow. Check that yours sets a deadline in hours and says when the vendor's clock starts. CERT-In's FAQs say any entity that notices an incident must report it, so the vendor may owe its own report too.
5. 5.What about the police? Consistent with our framework: never delay the Board, whose intimation is not public; get the request in writing with a reason and a length; defer individual notices only briefly, and not where harm is immediate. An extortion email suggests it may be.

The after-action report

Within a week, the facilitator circulates two pages:

1. 1.A timeline of each decision against each clock, from the scribe's notes.
2. 2.What worked, and the gaps that mattered most.
3. 3.For each gap, an owner, a fix and a date before 13 May 2027.
4. 4.Missing templates and contacts: the Board intimation, the parent notice, the vendor escalation route.
5. 5.A date for the next drill, with a different scenario: ransomware, an insider or a misdirected email.

Book the date

Run the first exercise this quarter, while contracts and templates can still change before May 2027, and a second in April 2027 with the fixes in place. Failing to notify the Board or affected people carries a penalty of up to ₹200 crore. If the room spends ten minutes arguing about who decides, that is the most useful finding of the day.

Key takeaways

• A 90-minute tabletop with eight decision-makers, a facilitator and a scribe tests the DPDP and CERT-In clocks without touching systems.
• Script five injects: discovery (T+0), vendor confirmation (T+2h), the CERT-In six-hour deadline (T+6h), Board intimation and a police request (T+24h), and the 72-hour Board report (T+72h).
• Test the hard calls: whether s.2(u) is met, who gets Rule 7 notices (parents for under-18s), what the notice says, when the vendor had to tell you, and how to answer a police hold.
• In line with Trayambic's breach framework, never delay the Board for a police request; defer individual notices only briefly, on a written request.
• Close with an after-action report that gives every gap an owner and a date before 13 May 2027.