What the DPDP Act requires
On a personal-data breach, a Data Fiduciary must give notice to the Data Protection Board of India and to each affected Data Principal, in the form and manner the Rules prescribe. The duty applies broadly — the Act does not read in a "risk of harm" threshold the way some laws do — so you need a process that triggers reliably and produces a defensible record.
The failure regulators penalise most is not the breach itself, but the absence of a process — late notice, no records, no idea who was affected.