Identify applicable reporting duties immediately. Containment and reporting run concurrently.
Commencement matters: the substantive processing duties, breach-reporting requirements and penalty adjudication provisions discussed here belong to the eighteen-month phase after Gazette publication under G.S.R. 846(E) and Rule 1. They are not yet operative. Existing CERT-In and other applicable legal obligations continue independently. A 72-hour DPDP follow-up period does not permit delay in CERT-In reporting or in initial intimation required without delay. Read the commencement notification and Rules 1 and 7. The relevant Schedule ceilings are upto Rs 200 crore for a notification breach and upto Rs 250 crore for a security-safeguard breach, subject to inquiry and Section 33 factors, not automatic penalties.
Parallel response tracks — not sequential waiting periods
Contain and assess reporting in parallel
- ▸Record the time the incident was noticed or brought to notice and the time a personal data breach became known.
- ▸Activate security, legal and management decision-makers; identify covered entities and the applicable reporting regimes immediately.
- ▸Contain active harm and preserve logs, system images where safe, and chain-of-custody records. Evidence preservation must not delay necessary containment or reporting.
- ▸Record what is known and what remains uncertain. Do not wait for a complete forensic investigation before an applicable initial notification.
CERT-In reporting where applicable
- ▸For incidents and entities covered by the CERT-In Directions, report within six hours of noticing the incident or being brought to notice.
- ▸Send the available initial information within that period and supplement it as facts emerge.
- ▸An incident noticed at 09:00 must therefore be reported by 15:00 that day where the six-hour requirement applies.
- ▸Assess sectoral, contractual and insurance notices concurrently; a later deadline under another regime does not extend this one.
DPDP initial intimations once operative
- ▸Under Rule 7, intimate the Board and each affected Data Principal without delay on becoming aware of a personal data breach.
- ▸The Board intimation describes nature, extent, timing, location and likely impact to the extent known.
- ▸Tell each affected Data Principal the nature, extent and timing, likely consequences, mitigation, safety steps they can take, and a business contact for questions.
- ▸Do not defer these initial notices to a 24-hour or 72-hour slot. Rule 7 does not impose a separate Board-selected severity threshold for affected Data Principal intimation.
Detailed Board report once operative
- ▸Provide updated detail, the broad facts and reasons, mitigation, findings about the person responsible, remedial measures and a report on Data Principal intimations.
- ▸The period runs from awareness of the personal data breach. An extension requires the Board to allow a longer period on a written request; it is not self-granted.
- ▸For awareness at 09:00, the ordinary detailed-report deadline is 09:00 three days later. Initial notices without delay and the earlier CERT-In deadline remain separate.
- ▸State uncertainties and further investigative steps accurately; do not invent a completed forensic conclusion.
Remediation and evidence
- ▸Maintain a reporting log, recipient records, delivery acknowledgements, decision rationale and updated incident chronology.
- ▸Coordinate affected vendors, remedial work and appropriate communications; check each party’s legal and contractual duties.
- ▸Review access controls, retention and recovery measures, and track outstanding corrective actions.
- ▸Assess legal professional privilege for qualifying advocate-client communications under Sections 132–134 of the Bharatiya Sakshya Adhiniyam; not every incident record is privileged.
Board Intimation: What Management Must Know
The board of directors or senior management briefing should cover seven points:
- 1Nature of the breach — what happened, when, how
- 2Scope — categories of data, estimated number of Data Principals affected
- 3Children’s data involvement — assess Section 9 obligations and exemptions; involvement alone does not establish a separate breach
- 4Containment status — is the breach ongoing, contained, or fully remediated
- 5Regulatory timeline — notification obligations and deadlines
- 6Penalty exposure — applicable penalties under the DPDPA Schedule
- 7Legal privilege — whether the investigation should be conducted under legal privilege to protect communications with advocates under Sections 132–134 of the Bharatiya Sakshya Adhiniyam, 2023
Parallel Reporting Obligations
Assess the precise regulated entity, incident trigger, notification instrument and deadline for each applicable regime. Do not assume one regulator’s notice satisfies another:
- ▸CERT-In: Reporting covered incidents within six hours of noticing or being brought to notice. Available initial information can be supplemented; see the official FAQs
- ▸RBI: Reporting obligations for banks, NBFCs, and payment system operators under RBI cyber security framework
- ▸SEBI: Reporting for listed entities and market intermediaries under SEBI cyber security framework
- ▸IRDAI: Reporting for insurance companies under IRDAI information and cyber security guidelines
- ▸Stock exchange disclosure: Material event disclosure for listed entities under SEBI LODR Regulations
CERT-In Directions FAQs · DPDP Rules 1 and 7 · DPDP Act and Schedule
Related Reading
Frequently Asked Questions
Is 72 hours a general waiting period?
No. Once Rule 7 is operative, initial intimation to the Board and each affected Data Principal is without delay; a detailed Board report follows within 72 hours of awareness, or a longer period allowed on written request. Applicable CERT-In incidents must separately be reported within six hours of noticing or being brought to notice.
Is Rule 7 already operative?
Commencement matters: the substantive processing duties, breach-reporting requirements and penalty adjudication provisions discussed here belong to the eighteen-month phase after Gazette publication under G.S.R. 846(E) and Rule 1. They are not yet operative. Existing CERT-In and other applicable legal obligations continue independently.
Can initial reporting wait for full forensics?
No. CERT-In permits available initial information to be supplemented. Rule 7 also distinguishes the initial intimation without delay from the detailed Board report. Containment, evidence preservation and reporting decisions run concurrently.
Is a Consent Manager mandatory?
No. Section 6(7) gives the Data Principal the option to give, manage, review or withdraw consent through a Consent Manager. Direct consent and processing under the specified certain legitimate uses in Section 7 require their own analysis; a Consent Manager is not mandatory for every processing operation.
What penalty relates to failure to notify?
Schedule item 2 provides upto Rs 200 crore for breach of Section 8(6), covering notice to the Board or affected Data Principal. This is a ceiling subject to commencement, inquiry, hearing and Section 33 factors, not an automatic fine for every incident.
Data Breach? Act Now.
Every hour counts. We provide immediate breach response counsel — forensic coordination, Board notification preparation, Data Principal communication, and regulatory strategy.