Incident response and Board notification
Contain the incident and assess reporting immediately. Different regimes have different triggers.
Commencement matters: the substantive processing duties, breach-reporting requirements and penalty adjudication provisions discussed here belong to the eighteen-month phase after Gazette publication under G.S.R. 843(E) and Rule 1. They are not yet operative. Existing CERT-In and other applicable legal obligations continue independently.
For a reportable CERT-In incident noticed at 09:00, the six-hour deadline is 15:00 the same day. Do not postpone the initial report until a later DPDP workstream. Once Rule 7 is operative, initial Board and affected Data Principal intimations are without delay; the detailed Board report is within 72 hours of awareness or a longer period the Board allows on written request.
Provide the incident timeline, logs, affected data and systems, vendor contracts, prior notices and any regulator correspondence. Share only the minimum initial facts before conflicts and engagement scope are confirmed. The legal analysis identifies reporting recipients, deadlines, content requirements and evidence gaps; it does not assume a complete forensic finding.
Record discovery and awareness times, affected systems, data categories and entities. Determine applicable CERT-In, sector, contractual and prospective DPDP reporting duties immediately.
Prepare available information for any six-hour CERT-In report; once operative, Rule 7 initial intimations are without delay and the detailed Board report is due within 72 hours unless extended by the Board on written request.
Coordinate safe containment with preservation of logs, access records, relevant vendor communications and custody records. Do not wait for full forensics before required reporting.
Identify affected individuals and communication channels, likely consequences, mitigation and practical safety steps. Avoid speculative assurances that no harm occurred.
Document responsible decision-makers, escalation, supplier cooperation, contractual notice and remediation duties. Privilege depends on the communication and legal requirements, not merely the incident label.
Prepare a trigger-and-deadline matrix, notification drafts, evidence index, management briefing, remedial action log and follow-up report within the agreed scope.
No. Once Rule 7 is operative, initial intimation to the Board and each affected Data Principal is without delay; a detailed Board report follows within 72 hours of awareness, or a longer period allowed on written request. Applicable CERT-In incidents must separately be reported within six hours of noticing or being brought to notice.
Commencement matters: the substantive processing duties, breach-reporting requirements and penalty adjudication provisions discussed here belong to the eighteen-month phase after Gazette publication under G.S.R. 843(E) and Rule 1. They are not yet operative. Existing CERT-In and other applicable legal obligations continue independently.
No. CERT-In permits available initial information to be supplemented. Rule 7 also distinguishes the initial intimation without delay from the detailed Board report. Containment, evidence preservation and reporting decisions run concurrently.
No. Section 6(7) gives the Data Principal the option to give, manage, review or withdraw consent through a Consent Manager. Direct consent and processing under the specified certain legitimate uses in Section 7 require their own analysis; a Consent Manager is not mandatory for every processing operation.
Schedule item 2 provides upto Rs 200 crore for breach of Section 8(6), covering notice to the Board or affected Data Principal. This is a ceiling subject to commencement, inquiry, hearing and Section 33 factors, not an automatic fine for every incident.
Share the key facts for a confidential preliminary assessment of your India matter.