Home › Legal › Breach Notification SOP

Breach Notification SOP

Last updated: 25 October 2026 · Version 1.0 · Owner: Mr. Vikas Saini, Director (Technical)

Version history: v1.0 — 25 October 2026 (initial publication). v1.1 — 25 October 2026 (audit fixes). See /legal/CHANGELOG.md.

Hindi summary available. Yeh dastaavez English me legally valid hai. Hindi me chahiye to security@digitaliiisla.co.in par likhein.

1. Scope

This SOP applies to any Personal Data Breach (DPDPA 2023 s. 2(u)) affecting data processed through DigiSurvey — whether by Digitaliiisla directly, by a sub-processor, or by an unauthorised third party. “Breach” includes unauthorised access, accidental disclosure, loss, alteration, destruction or availability failure that compromises confidentiality, integrity or availability of Personal Data.

2. Detection

Breaches are detected through:

Automated monitors — Supabase SQL audit alerts, Cloudflare WAF events, bot-management rate spikes, abnormal row-delete triggers, failed-login velocity, 5xx error patterns, backup-pipeline failures.
Manual channels — security@digitaliiisla.co.in inbox, surveyor support tickets, insurer customer reports, responsible-disclosure reports from external researchers.
Sub-processor notifications — incoming breach notices from Supabase, Cloudflare, Google, Resend, Zoho, Backblaze, Razorpay (contractual).
Internal discovery — routine access-log review, code review, audit.

3. Internal escalation

Any signal of a potential breach triggers the following within 2 hours of first detection:

On-call engineer opens an incident ticket (severity-tagged) and pages the Director (Technical).
A War Room is opened on an isolated chat (Slack private channel + conference bridge) and both Directors join.
A dedicated scribe is appointed to maintain the incident timeline — immutable, append-only, time-stamped.
Access to any potentially compromised system is restricted to the incident response team.
Legal (external counsel on retainer) is placed on standby.

4. Classification

Within 4 hours of escalation, the breach is classified using the DPDPA risk framework:

Severity	Trigger	Example
High	Confirmed exfiltration or disclosure of identifiable personal data of ≥ 100 Data Principals, or any disclosure of financial / biometric / sensitive data regardless of count, or ransomware with data egress confirmed.	Credential stuffing attack succeeds against an admin account and the attacker pulls a survey table.
Medium	Possible exposure of personal data of < 100 Data Principals, or unauthorised access without confirmed data pull, or significant availability event > 4 hours.	Illustrative — hypothetical: A misconfigured RLS policy briefly allows one surveyor to list (not download) other surveyors’ survey IDs; patched within the hour.
Low	Near-miss, successful exploit of a non-production system, or disclosure limited to non-personal metadata.	A staging-environment leak that contained only synthetic test data.

5. Containment & eradication

Isolate the affected system (revoke sessions, rotate secrets, block offending IPs at Cloudflare, suspend compromised accounts).
Rotate every credential that could have been exposed — Supabase service role keys, Cloudflare API tokens, Cloudflare R2 S3-compatible keys, AWS IAM access keys, Razorpay keys, Backblaze application keys, Resend / Zoho API keys.
Patch the root cause before restoring access — no shortcut.
Preserve forensic evidence (log snapshots, memory dumps, access-log exports) under write-once storage.
If data was deleted, restore from the Stage 2 Backblaze backup; if data was altered, restore from the row-level deletion-shadow log.

6. External notification timeline

T = 0 h

Detection

First signal received through any detection channel.

T ≤ 2 h

Internal escalation complete

Incident ticket opened, War Room up, scribe assigned, Directors engaged.

T ≤ 4 h

Classification complete

High / Medium / Low severity set with evidence. Containment underway.

T ≤ 6 h (High severity only)

CERT-In notified

Where the breach falls within the CERT-In 2022 Cyber Security Directions’ reportable classes, we report via the CERT-In portal within 6 hours as required.

T ≤ 24 h

Insurer customers under DPA notified

Written notice to each affected enterprise customer with the facts known at that point, following the format in DPA Clause 11. We update them again at T = 48 h and T = 72 h.

T ≤ 72 h

Data Protection Board of India notified

Formal notice to the DPB in the form and manner prescribed by the Rules under DPDPA 2023, including nature of breach, categories and approximate numbers affected, likely consequences and measures taken or proposed.

T ≤ 72 h

Affected Data Principals notified

Direct communication (email + in-app banner where applicable) to each affected Data Principal with the facts, likely impact and recommended protective steps.

T ≤ 30 days

Public post-mortem (High severity only)

A redacted post-mortem is published on this page naming root cause, impact, remediation and preventive measures. Customer-specific details are redacted at the customer’s request.

7. Content of each notification

Every external notification carries the DPDPA-required facts:

Nature of the breach (what happened).
Categories and approximate number of Data Principals affected.
Categories and approximate number of records affected.
Likely consequences (and whether the data is encrypted, so impact is reduced).
Measures taken and proposed to address and mitigate the breach.
Named contact for follow-up (Grievance Officer — grievance@digitaliiisla.co.in).

8. Post-mortem commitment

Every High-severity breach gets a public blameless post-mortem within 30 days.
Every Medium / Low incident is captured in an internal register, reviewed quarterly by the Directors, and summarised to enterprise customers under NDA on request.
Preventive controls identified in the post-mortem are tracked to completion and audited at the next annual review.

9. Current incident register

The incident register is currently empty. First review will be conducted at the end of Q4 2026.

A reportable incident is any confirmed Personal Data Breach classified as Medium or High per Section 4. We will update this section within 7 days of any such incident, with the public post-mortem following within 30 days for High severity.

10. Reporting a potential breach

If you believe you have found a security vulnerability or a potential breach:

Email: security@digitaliiisla.co.in — acknowledged within 24 hours.
Phone (24/7): +91 83026 98307.
Please do not probe production without permission; the responsible-disclosure guidelines are in the Security Statement.