Comparison · India
CERT-In vs DPDP breach rules
India's two incident reporting regimes side by side: the CERT-In Directions of 28 Apr 2022 under the IT Act, and the personal data breach duty under s. 8(6) of the DPDP Act with Rule 7 of the DPDP Rules 2025. Written for a company that already reports to CERT-In and is working out what the DPDP clock adds, and for one that has built a DPDP playbook and forgotten the 6 hours.
Sources: CERT-In, Directions under s. 70B(6) of the IT Act, 2000 on information security practices and reporting of cyber incidents, 28 Apr 2022; CERT-In, Cyber security directions page; Digital Personal Data Protection Act, 2023 (Act 22 of 2023), Gazette copy; Digital Personal Data Protection Rules, 2025, G.S.R. 846(E)
Side by side
Twelve criteria, reviewed 4 Nov 2026. Each cell names its source. Scroll sideways on a phone.
| Criterion | CERT-In Directions (2022) | DPDP Act and Rules (India) |
|---|---|---|
| Legal basis | Directions issued by CERT-In under s. 70B(6) of the Information Technology Act, 2000 on 28 Apr 2022, effective 60 days later, from 28 Jun 2022.IT Act s. 70B(6); Directions of 28 Apr 2022 | s. 8(6) of the Digital Personal Data Protection Act, 2023 (Act 22 of 2023) and Rule 7 of the DPDP Rules 2025, notified 13 Nov 2025 as G.S.R. 846(E). Rule 7 comes into force eighteen months after publication, on 13 May 2027.s. 8(6); Rules 1(4), 7 |
| Who must report | Service providers, intermediaries, data centres, body corporates and government organisations. Individual citizens are not covered.Directions, para (ii); CERT-In FAQ Q7 | Every Data Fiduciary, the person who decides the purpose and means of processing. A Data Processor reports to its fiduciary under contract; the statutory duty sits with the fiduciary even when the processor caused the breach.s. 2(i), 8(1), 8(6) |
| What triggers it | Any cyber incident of the types listed in Annexure I (unauthorised access, data breach, data leak, ransomware, attacks on servers, networks and critical infrastructure, among twenty categories) and, per CERT-In's FAQ, other incidents of a severe nature. Not limited to personal data.Directions, para (ii); Annexure I; CERT-In FAQ Q9, Q10 | A personal data breach: any unauthorised processing, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability.s. 2(u) |
| Risk threshold | None. A listed incident is reported whether or not anyone was harmed.Directions, para (ii) | None. Every personal data breach is intimated, however small, to the Board and to each affected Data Principal. Contrast GDPR Art. 33, which excuses breaches unlikely to result in a risk.s. 8(6); Rule 7 |
| Who you tell | CERT-In only, by email to incident@cert-in.org.in or the other channels in Annexure I. The Directions create no duty to tell affected individuals.Directions, para (ii); Annexure I | The Data Protection Board of India and every affected Data Principal, the latter through her user account or any mode of communication she registered with the fiduciary.s. 8(6); Rule 7(1), 7(2) |
| The clock | Within 6 hours of noticing the incident or being brought to notice of it.Directions, para (ii); CERT-In FAQ Q24 | Without delay for the first intimation to the Data Principals and to the Board. A detailed report to the Board within 72 hours of becoming aware of the breach, or within a longer period the Board allows on a written request.Rule 7(1), 7(2) |
| What the report contains | CERT-In's incident reporting form: the type of incident, affected systems, time of occurrence and detection, and what is known so far. Further details can follow as the investigation proceeds.Directions, para (ii); Annexure I | To each Data Principal: the nature, extent and timing of the breach, the consequences likely for her, mitigation done, safety steps she can take, and a contact. To the Board first: description, nature, extent, timing, location and likely impact; then within 72 hours the facts and causes, mitigation, findings about who caused it, remediation, and a report of the intimations sent to Data Principals.Rule 7(1), 7(2) |
| Logs | Enable logs of all ICT systems and keep them securely for a rolling 180 days within Indian jurisdiction; produce them with the incident report or when directed. CERT-In's FAQ allows storage abroad if the logs can be produced in a reasonable time.Directions, para (iv); CERT-In FAQ Q35 | Keep logs, monitoring and review in place to detect unauthorised access, and retain those logs and the personal data concerned for one year unless another law requires otherwise. Logs are a named reasonable security safeguard, and failing on safeguards carries the highest penalty.Rule 6(1)(c), 6(1)(e); s. 8(5) |
| Other standing duties | Synchronise clocks to NIC or NPL NTP servers; designate a point of contact to CERT-In; data centres, VPS, cloud and VPN providers keep validated subscriber records for five years; virtual asset providers keep KYC and transaction records for five years.Directions, paras (i), (iii), (v), (vi) | Reasonable security safeguards (encryption or masking, access control, logs, backups, safeguards in processor contracts); a published contact who can answer questions about processing; grievance redressal within a published period not exceeding 90 days.s. 8(5), 8(9), 8(10); Rules 6, 9, 14(3) |
| Regulator's follow-up | CERT-In collects, analyses and disseminates incident information, issues alerts and advisories, coordinates response and may call for information from any service provider, intermediary, data centre or body corporate.IT Act s. 70B(4), 70B(6) | On receiving an intimation the Board may direct urgent remedial or mitigation measures, inquire into the breach and impose a penalty. The Board functions as a digital office; appeals go to the Telecom Disputes Settlement and Appellate Tribunal.s. 27(1)(a), 28, 29 |
| Penalty for not reporting | Failing to furnish information or to comply with the Directions is an offence: imprisonment up to one year, or a fine up to Rs 1 lakh, or both.IT Act s. 70B(7) | Up to Rs 200 crore for failing to notify the Board or an affected Data Principal, imposed by the Board after inquiry. Failing to take reasonable security safeguards, the usual cause of the breach, is a separate item at up to Rs 250 crore.s. 33; Schedule, items 1, 2 |
| Does one report satisfy the other | No. The Directions stand on their own under the IT Act. A personal data breach that is also a listed cyber incident (most are) goes to CERT-In within 6 hours whatever else you do.Directions, para (ii) | No. The Act is in addition to other laws and prevails in a conflict. Telling CERT-In does not tell the Board, and neither tells the Data Principal; both DPDP recipients are separate duties.s. 8(6), 38 |
The differences that matter
Six hours is the binding constraint
DPDP's 72 hours is for the detailed report; its first intimation is 'without delay'. CERT-In's 6 hours is a hard deadline from the moment you notice the incident. In practice the CERT-In report goes first, with what you know, and the DPDP intimations follow once you know which personal data and which people are affected. Build the runbook around the 6 hours and the rest fits inside it.
Only DPDP makes you tell the people
The CERT-In Directions are a government-facing regime: the report goes to CERT-In and stops there. DPDP adds every affected Data Principal, with a plain-language message through her account or registered channel, and then a report to the Board on the intimations you sent. The customer communication, not the regulator filing, is where most companies will be caught unprepared.
Different definitions of a breach
CERT-In's trigger is a cyber incident from an illustrative list of twenty types, whether or not personal data was involved. DPDP's trigger is any compromise of personal data, whether or not it was a cyber attack: a misdirected email, an over-shared spreadsheet or a lost laptop is a personal data breach under s. 2(u) but may not be a CERT-In incident. Map both definitions in the incident classification step.
Two kinds of penalty
CERT-In's sanction is criminal and small: up to a year's imprisonment or Rs 1 lakh under s. 70B(7) of the IT Act, rarely prosecuted. DPDP's is civil and large: up to Rs 200 crore for the failure to notify and Rs 250 crore for the safeguards failure behind it, imposed by the Board after an inquiry. The reputational cost of telling every customer is the third penalty, and it applies under DPDP alone.
Questions
We already report to CERT-In. What changes under DPDP?
Three things. You tell two more parties, the Board and every affected Data Principal, not just CERT-In. You tell them without delay and file a detailed report to the Board within 72 hours, in the content Rule 7 prescribes. And the trigger widens from cyber incidents to any compromise of personal data, including human error. Your CERT-In report, log retention and point of contact carry over; your customer communication template and Board filing are new.
Does the DPDP breach duty apply today?
Not yet. The DPDP Rules were notified on 13 Nov 2025 as G.S.R. 846(E). Rules 1, 2 and 17 to 21 took effect on that day, Rule 4 on Consent Managers applies from 13 Nov 2026, and Rule 7 on breach intimation, with the other substantive rules, applies from 13 May 2027. The CERT-In Directions have applied since 28 Jun 2022 and apply now.
Can we ask the Board for more than 72 hours?
Yes, for the detailed report only. Rule 7(2)(b) lets the Board allow a longer period on a request made in writing. The first intimation to the Board and to each Data Principal must still be made without delay, and CERT-In's 6 hours cannot be extended.
Must our logs be stored in India?
Under CERT-In Direction (iv) logs are to be maintained within Indian jurisdiction for a rolling 180 days, though CERT-In's FAQ (Q35) accepts storage abroad if they can be produced in a reasonable time. DPDP Rule 6(1)(e) requires one year of retention for logs and the personal data concerned, with no location rule. Keep one year, in or accessible from India, and both are met.
Read next
This page explains the law in plain English. It is not legal advice.
Weekly · Watching 6 regulators