Data Breach Reporting in India 2026: CERT-In vs DPDP Rule 7

Published 3 October 2026 · 10 min read

Six hours to CERT-In today, 72 hours to the Data Protection Board from May 2027. India's two breach reporting clocks and how to be ready.

Data Breach Reporting in India 2026: CERT-In vs DPDP Rule 7

The short answer

An Indian company that suffers a data breach today is already working to a six-hour clock, not a 72-hour one. The CERT-In Directions of 28 April 2022 require cyber security incidents to be reported to CERT-In within six hours of noticing them, and those Directions are in force now. The 72-hour figure people quote comes from Rule 7 of the Digital Personal Data Protection Rules, 2025, which does not commence until roughly mid-May 2027 — and when it does, it adds an obligation rather than replacing the six-hour one.

So the practical answer to "how long do I have to report a data breach in India?" is: six hours to CERT-In today; from May 2027, six hours to CERT-In, intimation to every affected individual without delay, immediate first intimation to the Data Protection Board, and a detailed follow-up report to the Board within 72 hours. Stratgik is a technology firm, not a law firm; the guidance below is operational, and the legal positions in it should be confirmed with your counsel.

What is actually in force in October 2026

Two separate regimes are relevant, and they come from different statutes with different regulators.

CERT-In Directions, 2022. Issued under section 70B(6) of the Information Technology Act, 2000 and effective 60 days after 28 April 2022, these apply to service providers, intermediaries, data centres, body corporates and government organisations. They require a long list of incident types — data breaches and leaks, attacks on digital payment systems, unauthorised access to social media accounts, attacks on cloud and IoT systems, malicious mobile applications — to be reported within six hours of noticing the incident. They also require ICT logs to be kept for 180 days and stored within India, and system clocks synchronised to NIC or NPL time servers. The Directions set no materiality threshold: a small incident is reportable on the same clock as a large one.

DPDP Act, 2023 and DPDP Rules, 2025. The Act needed subordinate rules to become operational. Those Rules were notified on 13 November 2025 by G.S.R. 846(E) and commence in three phases over eighteen months. Only the Board-constitution and procedural rules — Rules 1, 2 and 17 to 21 — took effect on notification. Rule 4, on Consent Manager registration, follows in November 2026. Everything that creates day-to-day duties for ordinary businesses, including Rule 7, arrives in May 2027.

Sources differ by a day on the phase dates, because the notification is dated 13 November 2025 while gazette publication is commonly counted from 14 November. Plan to 13 November 2026 and 13 May 2027 and the one-day question becomes irrelevant.

The two clocks, side by side

Question	CERT-In Directions, 2022	DPDP Rule 7 (from ~May 2027)
In force now?	Yes	No — commences eighteen months after 13 November 2025
Who must report	Service providers, intermediaries, data centres, body corporates, government organisations	Data Fiduciaries (anyone determining the purpose and means of processing digital personal data)
Report to whom	CERT-In	Affected Data Principals, and the Data Protection Board of India
Deadline	6 hours from noticing the incident	Data Principals: without delay. Board: initial intimation without delay; detailed report within 72 hours
Trigger	Any listed cyber security incident — no severity threshold	Any personal data breach — no severity threshold in the Rule
Log retention	180 days, stored in India	Rule 6 requires logs and personal data to be retained for at least one year
Exposure	Penal consequences under the IT Act for non-compliance	Up to ₹200 crore for failing to notify a breach; up to ₹250 crore for failing to maintain reasonable security safeguards

Read the last row carefully. The largest penalty in the Schedule to the DPDP Act attaches not to the notification failure but to the security-safeguards failure that caused the breach. Notification discipline matters, but it is the cheaper half of the problem.

What Rule 7 will actually require you to produce

Rule 7 splits into two distinct duties, and most internal incident-response plans we see are built for only one of them.

To each affected individual, without delay. The intimation must be concise, clear and in plain language, sent to the person through their user account or whatever communication channel they have registered. It must describe the nature, extent and timing of the breach; the consequences likely to affect that person; the measures the Data Fiduciary has implemented or is implementing to mitigate risk; safety steps the person can take themselves; and business contact details for queries.

That is a per-individual communication, not a website notice. If a breach touches 40,000 customers, you need to generate and send 40,000 intimations quickly, through channels you can prove were registered — an engineering requirement disguised as a legal one, and the part most companies have not built.

To the Data Protection Board. First, an immediate intimation covering the nature, extent, timing, location and probable impact of the breach. Then, within 72 hours — or longer if the Board permits on written request — an updated and detailed account: the broader description, the circumstances and reasons for the breach, the mitigation measures implemented or proposed, findings on the person who caused it, preventive measures adopted against recurrence, and a report on the intimations actually sent to affected individuals.

That last item quietly raises the bar: you must demonstrate, inside 72 hours, who you told and when. Without delivery logs, you have an evidentiary gap in front of a regulator.

Why the gap between now and May 2027 is the work

It is tempting to read "May 2027" as permission to wait. Three reasons not to.

First, the six-hour CERT-In obligation already exists and is already difficult. The failure mode is almost always that detection and escalation are slow, not that the form takes long to fill in. Fixing that fixes the 2027 problem at the same time.

Second, Rule 6 requires logs and personal data to be retained for at least a year. CERT-In requires 180 days in India. If your logging today is 30 or 90 days, you cannot reconstruct an older breach — and an inability to answer "what exactly was accessed?" converts a contained incident into an unbounded one. Log retention changes take a budgeting cycle, not a sprint.

Third, the per-individual intimation requirement depends on knowing which data subjects were in which system at which time. For most companies, that is a data-mapping exercise lasting months. If you have not mapped personal data to systems, you cannot scope a breach, and if you cannot scope a breach, you cannot intimate accurately. This is where our DPDP compliance implementation work usually starts, and the sequencing matters more than the paperwork.

Sector regulators add their own clocks

If you are regulated by the RBI, SEBI or IRDAI, your fastest obligation may not be either of the two above. Financial-sector entities operate under separate incident-reporting directions with their own windows and formats, sitting on top of CERT-In rather than replacing it. A single incident can trigger three or four reporting duties at once, each to a different recipient. Build the response plan around that: escalation is one decision, and the notifications that follow are a fan-out, not a sequence of judgement calls.

Who the Board is, and whether it is operating yet

The Data Protection Board of India was established in law when the Rules were notified on 13 November 2025. Its composition and functioning are governed by Rules 17 to 21, which took effect immediately. Its powers include directing urgent remedial measures after a breach, inquiring into breaches, imposing monetary penalties and accepting voluntary undertakings. Appeals from its orders lie to the TDSAT.

On staffing, be careful what you assume. MeitY issued a circular dated 6 May 2026 inviting applications for one Chairperson and four Member posts, through a Search-cum-Selection Committee process. Public confirmation of completed appointments has been limited since, and commentary on the Board's operational readiness varies. Verify its current staffing against MeitY's own notifications rather than inferring it. What is not uncertain is the May 2027 commencement date for the substantive rules.

A practical readiness checklist

Work through this in order. Each item is a prerequisite for the one after it.

Map personal data to systems. Which applications, databases, log stores, backups and third-party processors hold personal data, and whose? Without this, breach scoping is guesswork.
Fix detection and escalation first. Measure your current time from "a signal exists" to "a named person owns the incident". If it exceeds two hours, the six-hour clock is already unachievable.
Write the CERT-In report as a template, not a task. Pre-fill everything that does not change — entity details, contacts, infrastructure description — so the live work is only the incident facts.
Extend log retention. At minimum 180 days in India for ICT logs under CERT-In; plan for the one-year baseline Rule 6 sets, and confirm your cloud configuration actually keeps what you think it keeps.
Build the mass-intimation capability. Can you send a templated, per-person notice to every affected Data Principal through a registered channel, and produce delivery evidence afterwards? Test it on a sample of 10,000 records.
Maintain a standing 72-hour report skeleton. Sections for circumstances, cause, mitigation, findings on responsibility, preventive measures and intimation evidence — so the forensic team is filling gaps, not inventing structure.
Reconcile your processor contracts. A vendor that notices a breach must tell you fast enough for your clock, not theirs. Contractual notification windows of 48 or 72 hours are incompatible with a six-hour obligation.
Check whether you may be designated a Significant Data Fiduciary. Rules 12 and 13 then add annual DPIAs, independent audits, an India-based Data Protection Officer and algorithmic due diligence — a materially larger programme.
Rehearse. Run one tabletop exercise against the six-hour clock and one against the full fan-out including per-individual intimation. The failures you find will be organisational, not technical.

How much of this is technology work

More than most compliance programmes. Consent notices and policies can be drafted; data mapping, log retention, detection latency and mass intimation cannot. They are changes to systems, competing for the same engineering capacity as your product roadmap.

That is the real planning question for 2026: how much engineering time does DPDP readiness consume, and what does it displace? Teams that answer it now, with a scoped plan, spend considerably less than teams that answer it in early 2027 under deadline pressure. Our technology decision sprint is built for exactly this kind of scoping question, and our managed technology practice covers the detection, logging and monitoring side on an ongoing basis. Where the answer is a build — a consent ledger, an intimation service, a data inventory — we handle it under technology strategy and delivery.

Frequently asked questions

Do I have to report a data breach in India within 72 hours?

Not today, and not only within 72 hours when the Rules commence. The live obligation is six hours to CERT-In under the 2022 Directions. From approximately May 2027, DPDP Rule 7 adds intimation to affected individuals without delay, an immediate first intimation to the Data Protection Board, and a detailed report to the Board within 72 hours. The 72 hours applies to the detailed Board report, not to the initial notification.

When exactly does DPDP Rule 7 come into force?

Eighteen months after the DPDP Rules, 2025 were notified on 13 November 2025, placing commencement in mid-May 2027. Published analyses cite either 13 or 14 May 2027 depending on whether they count from the notification date or the gazette publication date. Plan to the earlier date.

Is there a minimum severity before a breach becomes reportable?

Neither regime sets a materiality threshold on its face. The CERT-In Directions list incident types without impact criteria, and Rule 7 applies to a personal data breach without a size qualifier. In practice this means your triage question is "is this a reportable category?" rather than "is this big enough?" — a materially different habit from GDPR's risk-based test.

What is the maximum penalty for a breach under the DPDP Act?

Under the Schedule to the Act, up to ₹250 crore for failure to maintain reasonable security safeguards and up to ₹200 crore for failure to notify a personal data breach. Actual penalties are determined by the Board having regard to the factors in the Act, so these are ceilings rather than expected outcomes. Confirm the current position with your legal advisers.

Do CERT-In and DPDP reporting replace each other?

No. They arise under different statutes, go to different authorities and serve different purposes — CERT-In is incident response for national cyber security, the Board is enforcement of individual data rights. A single incident can require both, plus any sectoral reporting your regulator imposes.

We are a startup with no Indian entity but Indian users. Does this apply?

The DPDP Act has extraterritorial reach over processing of digital personal data outside India where it relates to offering goods or services to Data Principals in India. The CERT-In Directions reach service providers and body corporates operating in India, including entities without physical infrastructure here. Both need a specific legal assessment of your structure; this is one to put in front of counsel early rather than assume your way through.

If you are working out what DPDP readiness means for your systems rather than your policies, start with our DPDP compliance implementation page, or see how we work with companies across the Indian market on our India hub. Written by the Stratgik team. Stratgik is a technology firm and not a law firm; nothing here is legal advice.

Sources

Keep reading