Under the DPDP Act you must notify affected people without delay and the Board within 72 hours of a breach. You cannot invent that process during a real incident — a tabletop drill is how you test it in advance.
What a tabletop is
A guided walkthrough of a realistic breach scenario with the real responders in the room (security, legal, DPO, comms, leadership) — no systems touched, just decisions, timings and gaps surfaced.
Pick a realistic scenario
Ransomware locking a customer database; a misconfigured bucket exposing records; a vendor breach; an employee emailing data to the wrong list. Choose one that fits your real risks.
Run the clock
Start from 'we just became aware' and track time. Who declares a breach? Who assesses scope? Who drafts the Data Principal notice? Who files with the Board, and can you hit 72 hours?
What to look for
- Unclear ownership or decision rights.
- No ready notification templates.
- Gaps in logs needed to assess scope (see Rule 6).
- Vendors who can't tell you quickly what happened.
- Slow legal/leadership sign-off.
Close the loop
Capture findings, fix the gaps, update the breach plan, and run it again periodically. A drill that doesn't change anything was theatre.
How DPDP Bridge helps
DPDP Bridge gives you a ready breach-response workflow and templates — and helps you drill them so the real thing is calm and on-time. Take the free assessment to see exactly where you stand and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.