Data Breach Reporting in India: Aligning CERT-In's Six-Hour Rule With the DPDP Rules

A cyber incident in India already starts a short clock. Since 2022, CERT-In has required specified incidents to be reported within six hours. From 13 May 2027, the Digital Personal Data Protection Rules, 2025 add a second, parallel set of obligations whenever personal data is involved.

The two regimes have different purposes, triggers and audiences. This note compares them and explains how to run a single response that satisfies both.

The CERT-In Directions

CERT-In issued Directions under Section 70B(6) of the Information Technology Act, 2000 on 28 April 2022. They apply to service providers, intermediaries, data centres, body corporates and government organisations. The key obligations are:

• report specified cyber incidents to CERT-In within six hours of noticing them or being told about them;
• maintain logs of ICT systems securely for a rolling period of 180 days, within India;
• designate a point of contact to interface with CERT-In; and
• synchronise system clocks with the prescribed time sources.

The list of reportable incidents is broad. It covers data breaches and data leaks as well as attacks such as ransomware and unauthorised access. CERT-In's focus is the security of the national cyber ecosystem, so the report concerns the incident, not the individuals affected.

The DPDP Rules: Rule 7

Under Section 8(6) of the DPDP Act and Rule 7 of the Rules, a Data Fiduciary that becomes aware of a personal data breach must notify two audiences.

Affected Data Principals must be told without delay, in a concise, clear and plain manner, through their user account or registered contact. The notice should cover the nature, extent, timing and location of the breach, its likely consequences, the mitigation measures taken, steps the individual can take, and a contact person.

The Data Protection Board receives two reports:

• an initial intimation without delay, describing the breach and its likely impact; and
• a detailed report within 72 hours of becoming aware, or a longer period if the Board allows it on written request. This covers the facts and causes, mitigation, findings on who caused the breach, remedial measures, and the notices sent to individuals.

Unlike the CERT-In regime, the DPDP framework has no materiality threshold. Any personal data breach is notifiable.

How the two regimes compare

Sector regulators, such as the RBI, SEBI and IRDAI, may impose additional reporting duties on regulated entities.

Running one playbook

An incident that compromises personal data will usually engage both regimes, and sometimes a sectoral one as well. A single, tested playbook should provide:

1. One triage step. At the outset, assess whether the incident is CERT-In reportable, whether personal data is involved, and whether a sector regulator must be told.
2. A decision owner. Name who decides on each notification, with legal, security and communications in the room.
3. Pre-approved templates. Draft CERT-In, Board and individual notices in advance, so the first hours go into facts, not drafting.
4. Consistent facts. Keep one incident record so that statements to CERT-In, the Board, regulators and individuals do not contradict each other.
5. Vendor obligations. Contracts should require processors to report incidents quickly enough for the business to meet a six-hour clock.
6. Log readiness. Configure retention to meet the longer of the two requirements.
7. Rehearsal. Run a tabletop exercise before May 2027, using a realistic scenario.

Conclusion

The CERT-In Directions and the DPDP Rules are complementary, not alternatives. One protects the security of systems, the other the rights of individuals. Businesses that combine them into one incident-response process will meet both sets of deadlines with less risk and fewer inconsistencies.

Frequently asked questions

What is the CERT-In reporting timeline?

Specified cyber incidents must be reported to CERT-In within six hours of being noticed or brought to notice, under the Directions of 28 April 2022.

What is the breach reporting timeline under the DPDP Rules?

From 13 May 2027, affected individuals and the Data Protection Board must be informed without delay, with a detailed report to the Board within 72 hours.

Does one breach need to be reported under both regimes?

Often, yes. A cyber incident that compromises personal data can be reportable to CERT-In and notifiable under the DPDP Rules.

This article is for general information only and is not legal advice. It reflects the law as understood on 14 October 2026.