Tool · Free · No sign-up
Breach notification clock
Answer four questions and see every reporting deadline that applies to you, with the clause that sets each one.
Your deadlines
Enter when you became aware of the incident and tick the rules that apply.
CERT-In
6hours
Report any of the incident types listed in the Directions' annexure, whether or not personal data is involved. Keep ICT system logs for 180 days within India.
In force · 28 Jun 2022CERT-In Directions under s. 70B(6) of the IT Act, 28 Apr 2022, para (ii)
DPDP · Board and Data Principals
72hours
First intimation to the Board without delay, then the full report within 72 hours or a longer period the Board allows on a written request. Each affected Data Principal is told without delay, in plain language, with what happened and what they can do.
Applies from · 13 May 2027DPDP Act 2023, s. 8(6); DPDP Rules 2025, Rule 7
The same deadlines as a table, with who must be told and the clause that sets it.
| Rule | Tell whom | Clock starts | Deadline | In your scenario | Status |
|---|---|---|---|---|---|
| CERT-In Directions, 2022 | CERT-In | Noticing the incident or being brought to notice of it | 6 h | See the state | In force · 28 Jun 2022 |
| DPDP Act, 2023 and Rules, 2025 | Data Protection Board of India, and each affected Data Principal | Becoming aware of the breach | 72 h | See the state | Upcoming · 13 May 2027 |
How the clock counts
Hours are clock hours, not working hours, and run through weekends and holidays. CERT-In counts from when you notice the incident or are told about it; DPDP and GDPR count from when you become aware. Rule 7 lets the Board allow a longer period for the full DPDP report on a written request; the clock shows the default. A deadline that has passed is shown in red with how long ago it fell. The DPDP clock applies from 13 May 2027; before that date it shows what the Rules will require.
What the clock covers
Sources: each regulator's own document, as cited
| Regime | Clock | Starts when | Tell | Status |
|---|---|---|---|---|
| CERT-In Directions, 2022 | 6 hours | Noticing the incident or being brought to notice of it | CERT-InCERT-In Directions under s. 70B(6) of the IT Act, 28 Apr 2022, para (ii) | In force |
| DPDP Act, 2023 and Rules, 2025 | 72 hours | Becoming aware of the breach | Data Protection Board of India, and each affected Data PrincipalDPDP Act 2023, s. 8(6); DPDP Rules 2025, Rule 7 | Upcoming · 13 May 2027 |
| SEBI Cybersecurity and Cyber Resilience Framework | 6 hours | Noticing or detecting the incident | SEBI, and CERT-InSEBI circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, 20 Aug 2024 | In force |
| RBI cyber incident reporting | 6 hours | Detecting the incident | RBI (and CERT-In under the Directions above)RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, 7 Nov 2023 | In force |
| GDPR, Articles 33 and 34 | 72 hours | Becoming aware of the breach | The lead supervisory authority; individuals when the risk to them is highRegulation (EU) 2016/679, Art. 33(1) and 34(1) | In force |
| US state breach notification laws | Varies | Discovering the breach | Affected residents, and the state attorney general or regulator above each state's thresholdNational Conference of State Legislatures, security breach notification laws | In force |
Sources: CERT-In Directions under s. 70B(6) of the IT Act, 28 Apr 2022, para (ii); DPDP Act 2023, s. 8(6); DPDP Rules 2025, Rule 7; SEBI circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, 20 Aug 2024; RBI Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices, 7 Nov 2023; Regulation (EU) 2016/679, Art. 33(1) and 34(1); National Conference of State Legislatures, security breach notification laws
This page explains the law in plain English. It is not legal advice.