DPDP breach notices and CERT-In reports run on different clocks

“Report a breach within seventy-two hours” is an incomplete instruction for an Indian incident plan. It can hide an earlier reporting obligation, confuse the recipient and encourage a team to wait for an investigation that is still developing. The useful question is which rule applies to which event and what it requires first.

As of 22 October 2026, the main DPDP breach obligations are scheduled for 13 May 2027 under the commencement notification. The CERT-In Directions discussed below already operate within their own scope. A readiness plan should distinguish current duties from the future DPDP process.

CERT-In has its own coverage and clock

The Directions dated 28 April 2022 address service providers, intermediaries, data centres, body corporates and government organisations. Covered entities must report specified cyber incidents within six hours of noticing them or being brought to notice. Annexure I includes data breaches and data leaks among reportable categories.

This is not a direction that every individual citizen must report every personal mistake. The official FAQ explains the coverage and other operational questions. An organisation should assess both whether it is a covered entity and whether the incident falls within the specified categories.

The clock should not be silently restarted when an incident reaches senior management. Preserve when the event first became known and how the organisation assessed it. Internal escalation is supposed to support the external obligation, not redefine its starting point.

Initial information need not be the final investigation

The CERT-In FAQ recognises that complete information may not be available within the initial reporting period. Available information can be submitted first, followed by additional information within a reasonable time.

That matters when a supplier alert arrives with an uncertain affected population. Waiting for a perfect count can consume the reporting window. A response team should distinguish an unknown fact from a reason to take no reporting action.

Keep a record of the initial submission, later updates and any communication with the authority. The team also needs a process for correcting an earlier estimate when investigation changes the facts. Accuracy includes making uncertainty visible and updating it promptly.

Future DPDP notifications have three stages

Rule 7 of the final DPDP Rules requires a Data Fiduciary, on becoming aware of a personal data breach, to inform each affected individual without delay in the prescribed manner. The information includes the nature, extent and timing, likely consequences, mitigation, protective steps and a business contact.

The rule separately requires initial information to the Data Protection Board without delay. A detailed update to the Board follows within seventy-two hours of awareness, or within a longer period allowed by the Board on a written request.

These are distinct requirements. Seventy-two hours is not the initial notice deadline for affected people. It is not a universal waiting period for the Board either. Nor does the final rule introduce a general harm threshold allowing all apparently low-impact breaches to be ignored.

Work through one hypothetical incident

Suppose a covered online retailer learns at 10 am that an order export was available through an unauthorised public link. The administrator closes the link at 10.15 am. The supplier cannot confirm the access history until the following day.

The retailer must promptly assess the existing CERT-In requirements using the original awareness facts. Closing the link does not answer whether a reportable incident occurred, and the delayed access history does not necessarily justify waiting to report available information.

Once the future DPDP regime is operative, the retailer would also assess the personal data breach against the Act’s definition and Rule 7. Its plan would start the individual and initial Board information processes without delay, while preparing the later detailed Board update. The two legal routes should share verified facts but retain their own recipients and requirements.

Build a reporting register with separate rows

For each applicable obligation, record the legal source, covered entity, event type, starting point, recipient, initial information, follow-up requirements and owner. Add sector and contractual duties where relevant. Do not compress everything into a single spreadsheet cell labelled “deadline”.

Assign a backup who can submit if the usual contact is unavailable. Keep templates accessible, but ensure they invite facts rather than unsupported reassurance. Test the register with an incomplete incident, because real responses rarely begin with a finished report.

A carefully maintained chronology helps the organisation explain its decisions. More fundamentally, it helps the team act on the correct clock while the investigation is still underway.