SCENARIO M01 · SECURITY & BREACH
A hospital incident affects appointment records. How should the future Rule 7 timing be described?
IN PLAIN ENGLISH
Why you are seeing this step
This field note uses one realistic decision to separate the official source, an editorial interpretation, a practical option, evidence to keep, and any uncertainty that still depends on your facts.
Educational only, not legal advice. Source status is dated 13 May 2027; inspect the official links below before relying on it.
BEST NEXT STEP
Affected people and the initial Board description are without delay; detailed Board information follows within 72 hours unless extended.
Build the runbook around the distinct recipients, content and timing rather than repeating a single generic deadline.
WHY THE OTHER INSTINCTS MISS
Affected people and the initial Board description are without delay; detailed Board information follows within 72 hours unless extended.
Correct. The 72-hour period attaches to future Rule 7(2)(b), not every communication.
Every affected person must receive every investigation detail within 72 hours.
That misstates the recipient and content of Rule 7(2)(b).
Wait 72 hours before telling anyone.
Future Rule 7 uses “without delay” for affected principals and the initial Board description.
BUILD THIS EVIDENCE
Awareness timestamp, affected-person notice, initial Board intimation, 72-hour detail pack and extension request if any.
This artefact supports review. It does not certify compliance or replace advice on your facts.
- Guidance type
- legal requirement
- Pinpoint
- Act s. 8(6); Rule 7(1), 7(2)(a)–(b); G.S.R. 843(E) and 846(E)
- Reviewed
- 2026-08-30
- Change note
- Status and pinpoint reviewed against the official Act, final Rules, commencement notification and corrigendum for this educational website.
OFFICIAL SOURCE TRAIL
Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) ↗
Definitions and specified machinery provisions are operative; most substantive duties and rights are notified for later commencement. Check each scenario's status record.
Act s. 1(2); provision-specific section pinpointsDigital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) ↗
Final Rules with phased commencement. Scenario pinpoints identify the particular Rule being taught.
Rule 1(2)–(4), read with the corrigendumDPDP Act commencement notification G.S.R. 843(E) ↗
Appoints immediate, one-year and eighteen-month commencement cohorts for the Act.
G.S.R. 843(E), clauses (a)–(c)