Why data breach response is a board-critical cyber risk issue for BFSI

The first 72 hours of a breach can determine an organization’s regulatory, financial and reputational outcomes.

Over the past decade, financial institutions in India have invested heavily in cybersecurity controls, but the most significant regulatory failures rarely stem from the absence of controls. They emerge from how organizations respond once those controls fail.

The Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025, fundamentally reframe data breaches — from technical incidents into time-bound regulatory events. For banks and insurers, this is not simply another compliance layer; it is a test of incident maturity, decision-making discipline and board-level oversight under pressure.

The DPDP Act established accountability. The Rules introduce measurability. Under DPDP, ‘reasonable security safeguards’ will increasingly be judged in hindsight — not by what was procured, but by whether safeguards enabled timely detection, evidence preservation and defensible decision-making. The Rules then operationalize this expectation by asking a simple but powerful question after every breach: How quickly did you detect, assess, contain and report using evidence, not hindsight explanations?

The Draft Rules hinted at this, but the final DPDP Rules 2025 remove ambiguity. Breach reporting timelines are defined, notification obligations are explicit and the role of incident documentation is central. Every breach is now a potential regulatory reconstruction exercise.

What will regulators examine after a breach?

India’s DPDP enforcement trajectory is likely to mirror global privacy regulators’ behavior, wherein penalties may vary, but scrutiny will focus relentlessly on organizational conduct during the regulator notification process in the first hours and days of a breach. They will focus on the organization’s DPDP breach response.

Key forensic questions regulators are likely to ask:

• When did the organization first detect suspicious activity?
• When did it internally conclude that personal data was affected?
• What evidence supports that conclusion?
• Why did notifications occur when they did?
• Were decisions documented contemporaneously or reconstructed later?

The DPDP Rules make asking these questions unavoidable by mandating 72-hour reporting to the Data Protection Board and customer notification without delay. Most regulatory penalties in cyber incidents are not driven by how a breach occurred, but by what organizations did, or failed to do, upon discovery. 

The 72-hour window: A forensic stress test

The 72-hour data breach reporting requirement does not provide much time to deal with a live cyber incident, especially in BFSI environments with complex legacy systems, multiple vendors and large customer datasets. However, the Rules do not expect a completed forensic investigation within 72 hours. They expect forensic incident maturity, reflected as:

• A defensible preliminary assessment
• Evidence-based reasoning
• Demonstrable containment actions

A strong response uses forensics to answer just enough questions early:

• Is personal data involved?
• What categories of data?
• Approximate scale?
• Is there plausible harm?

Waiting for certainty is the fastest way to miss statutory deadlines.

Customer notification as part of regulatory breach obligations

The requirement to notify affected individuals “without delay” introduces a uniquely difficult balancing act, especially for banks and insurers. 

What this means for various stakeholders in an organization: 

• For CISOs: detection, evidence, escalation speed
• For General Counsel: defensible decision logs, regulator alignment
• For Boards: authority delegation, simulation participation

Regulators are far more forgiving of incomplete but honest notifications about data breach reporting than of delayed disclosures justified by “ongoing investigation.”

Boards should understand that customer notifications are now part of incident containment, not a post-incident activity.

The overlooked challenge: Parallel regulator reporting

In BFSI, DPDP reporting rarely occurs in isolation. Banks and NBFCs should continue reporting cyber incidents to the Reserve Bank of India, often on an immediate or near-real-time basis. Insurers face similar expectations from the Insurance Regulatory and Development Authority of India. Certain incidents also trigger reporting to CERT-In.

From a forensic coordination standpoint, this creates three risks:

• Inconsistent narratives across regulators
• Timeline conflicts between cyber and privacy reporting
• Evidence gaps caused by parallel, uncoordinated disclosures

Mature organizations treat breach response as a single orchestration problem, with tailored outputs for each regulator.

The strongest signals of board readiness are:

• Pre-approved regulator and customer notification templates
• Clear delegation of authority during incidents
• Regular breach simulation exercises involving legal, IT, compliance and communications
• Vendor contracts that support 72-hour reporting