Most businesses discover they are running two separate breach clocks at the worst possible time, in the middle of an actual incident.
As part of our DPDP series, explore our previous articles covering the DPDP Act, key roles and responsibilities, the compliance roadmap, and breach response requirements.
This post covers the other clock most Indian businesses don’t know they’re already subject to: CERT-In’s 6-hour rule, and how the two actually work together on the same incident.
Ashok’s IT services company in Chennai, the business we’ve followed through this series, is where we’ll trace this again, the same stolen laptop with client backup credentials on it.
Two different laws, two different regulators
DPDP and CERT-In are not the same law wearing two names.
CERT-In’s reporting rule comes from Section 70B of the Information Technology Act, 2000, enforced by the Indian Computer Emergency Response Team, a body that has existed since long before DPDP.
DPDP’s 72-hour obligation is a separate law entirely, enforced by the Data Protection Board, a body created specifically for data protection.
They exist for different reasons. CERT-In cares about cybersecurity incidents generally, protecting India’s digital infrastructure. DPDP cares specifically about personal data, protecting individuals whose information was affected. A single bad day can trigger both at once, but neither one replaces the other.
What actually triggers each one
CERT-In’s reporting duty is broad and covers roughly twenty categories of cyber incidents, far beyond personal data: targeted scanning of networks, identity theft, phishing, ransomware and other malicious code attacks, unauthorised access to systems, website defacement, attacks on digital payment systems, attacks on IoT devices, and, notably, data breaches and data leaks specifically named as one of the listed categories.
DPDP’s trigger is narrower and specific: a personal data breach. Not a DDoS attack with no personal data involved, not a phishing attempt that was blocked before anything was accessed, specifically an incident affecting personal data.
The overlap is common but not automatic. Most personal data breaches involve some kind of cyber incident, an unauthorised access, a stolen device, a compromised system, which means most DPDP-triggering events also land on CERT-In’s list. But not every CERT-In-reportable incident involves personal data, a DDoS attack against your website with no data exposure triggers CERT-In alone. For Ashok’s stolen laptop, both were triggered: it was both a data breach (CERT-In’s list) and a personal data breach specifically (DPDP’s trigger).
The two clocks, side by side
| CERT-In | DPDP | |
|---|---|---|
| Legal basis | IT Act, 2000, Section 70B | DPDP Act, 2023 |
| Regulator | CERT-In | Data Protection Board |
| Clock starts | On noticing, or being notified of, the incident | On becoming aware of the personal data breach |
| Deadline | 6 hours | Initial alert without delay; detailed report within 72 hours |
| What triggers it | ~20 categories of cyber incidents, personal data breach among them | Personal data breach specifically |
| Who else gets told | CERT-In only | The Board, and every affected individual |
| Partial information | ~Allowed, report what you know within 6 hours, add detail later | Detailed report expected within the 72-hour window |
How Ashok’s team actually ran both clocks together
Here’s the sequence once the laptop theft was confirmed:
Hour 0: Laptop theft confirmed, client backup credentials known to be exposed.
Within the first hour: IT resets the exposed credentials and isolates affected systems.
Within 6 hours: A report goes to CERT-In, since this qualifies as a data breach on their list. If full details aren’t available yet, CERT-In accepts a report with what’s known so far, more can follow later.
Same day: Without delay, once the relevant DPDP breach-notification provisions commence in May 2027: An initial notification goes to the Data Protection Board, separately from the CERT-In report.
Within 72 hours of becoming aware of the breach, once the relevant DPDP provisions commence in May 2027: The detailed report goes to the Board, unless it allows a longer period on a written request. Affected Data Principals must be notified without delay; their notification deadline is not 72 hours.
Two reports, two regulators, two formats, running on overlapping but separate clocks, off the same single incident.
What it costs to get either one wrong
Failure to comply with applicable CERT-In directions can attract imprisonment of up to one year, a fine of up to ₹1 crore, or both under Section 70B(7) of the IT Act. DPDP penalties are separate: failure to notify the Board or affected Data Principals can attract a penalty of up to ₹200 crore, while failure to take reasonable security safeguards to prevent personal data breaches can attract a penalty of up to ₹250 crore. These are statutory maximums, not automatic fines for every incident.
The practical point either way: these are two separate exposure risks, not one number covering both.
Why this is a backup and logging problem as much as a legal one
CERT-In’s Directions require organisations to maintain ICT system logs for a rolling 180 days, stored within India, separate from DPDP’s own retention expectations. The DPDP Rules also prescribe a separate one-year retention requirement for specified logs and personal data under their security-safeguard provisions, which are scheduled to commence in May 2027.
Meeting a 6-hour reporting deadline with meaningful information is much easier when relevant logs are already accessible and organised before an incident occurs. A reliable backup and retention strategy helps ensure that critical ICT logs remain available for investigation and incident reporting. Combined with appropriate log management, it helps businesses preserve and retrieve the 180 days of ICT logs required by CERT-In, with logs stored in India. Businesses should also verify that their logging, retention, storage-location, and retrieval practices meet the applicable requirements.
Getting this right before an incident is what makes hitting both the 6-hour and 72-hour clocks realistic rather than a scramble.
Frequently Asked Questions
Is CERT-In’s 6-hour rule the same as DPDP’s breach notification rule?
No. They are separate laws with separate regulators. CERT-In, under the IT Act, covers a broad range of cyber incidents within 6 hours. DPDP covers personal data breaches specifically, with an initial alert without delay and a detailed report within 72 hours.
Does every data breach trigger both CERT-In and DPDP?
Most do, since data breach is explicitly one of CERT-In’s reportable incident categories and would also typically qualify as a personal data breach under DPDP. But not every CERT-In-reportable incident involves personal data, so the two lists overlap without being identical.
What happens if a business misses the CERT-In 6-hour deadline?
Failure to comply with applicable CERT-In directions can attract imprisonment of up to one year, a fine of up to ₹1 crore, or both under Section 70B(7) of the IT Act. Exact figures have evolved over time and should be confirmed against current guidance.
Do businesses need to report to CERT-In even if personal data wasn’t involved?
Yes, if the incident falls into one of CERT-In’s other reportable categories, such as a DDoS attack, ransomware, or unauthorised system access, CERT-In’s 6-hour rule applies regardless of whether personal data was affected.
How long do businesses need to retain system logs under CERT-In?
CERT-In’s Directions require maintaining ICT system logs for a rolling period of 180 days, stored within India.
References
For more information, refer to the official legal documents below:
Digital Personal Data Protection Act, 2023
DPDP Act, 2023 — Commencement Notification, 13 November 2025
Digital Personal Data Protection Rules, 2025
official CERT-In Directions under Section 70B
Disclaimer: This article is intended for general informational purposes only and does not constitute legal advice. Businesses should consult qualified legal professionals to understand how the CERT-In & DPDP Act applies to their specific circumstances.
Follow our Twitter and Facebook feeds for new releases, updates, insightful posts and more.
