DPDP breach notification: 72 hours to the Board, 6 hours to CERT In

Search for the Indian data breach reporting deadline and you will find two different numbers: seventy two hours and six hours. Both are real, and they belong to two separate legal regimes with different recipients, different triggers and different coverage. If your organisation suffers a breach, you may owe both.

The two clocks side by side

	DPDP Rule 7	CERT In directions
Legal basis	DPDP Act 2023 and DPDP Rules 2025	Section 70B(6) of the IT Act 2000, direction No. 20(3)/2022 CERT In
Who reports	The Data Fiduciary	Service providers, intermediaries, data centres, body corporates and government organisations
Reports to	Each affected Data Principal, and the Data Protection Board of India	CERT In
What triggers it	Any personal data breach	Cyber incidents listed in Annexure I, including data breach and data leak
The clock	Without delay to affected people and the Board; detailed Board submission within seventy two hours of awareness	Within six hours of noticing or being brought to notice
Status today	In the commencement group computed to 13 May 2027, interpretation until confirmed	In effect

The DPDP clock: seventy two hours to the Board

Rule 7 of the DPDP Rules 2025 sets the personal data breach intimation duties. On becoming aware of any personal data breach, the Data Fiduciary must intimate each affected Data Principal without delay in a concise, clear and plain manner, and must intimate the Board in two stages:

"On becoming aware of any personal data breach, the Data Fiduciary shall intimate to the Board, — (a) without delay, a description of the breach, including its nature, extent, timing and location of occurrence and the likely impact; (b) within seventy-two hours of becoming aware of the breach, or within such longer period as the Board may allow on a request made in writing in this behalf …"

Rule 7(2), truncated before items (i) to (vi).

The trigger is awareness of any personal data breach, with no materiality threshold in the rule's text, and the only route to more time is a written request the Board allows. The full anatomy of this duty, the required contents and a working playbook are in the hour by hour breach response article.

The CERT In clock: six hours

Entirely separately, the CERT In directions of 28 April 2022, issued under section 70B(6) of the Information Technology Act 2000, set a cyber incident reporting duty that has been in effect since 2022:

"Any service provider, intermediary, data centre, body corporate and Government organisation shall mandatorily report cyber incidents as mentioned in Annexure I to CERT-In within 6 hours of noticing such incidents or being brought to notice about such incidents."

Direction (ii) of No. 20(3)/2022 CERT In.

Annexure I of the directions lists the reportable incident types, and items xi and xii are data breach and data leak. So a personal data breach at a body corporate is typically also a reportable cyber incident, and the CERT In clock is much shorter: six hours from noticing, not seventy two.

What this means in practice

Treat the two duties as parallel tracks with different owners. The CERT In report is a security team action on the six hour clock, already in force today. The DPDP intimations are a compliance and legal action on the without delay and seventy two hour clocks, due when Rule 7 commences on the computed date of 13 May 2027, interpretation until confirmed. They go to different recipients and neither substitutes for the other: reporting to CERT In does not intimate the Data Protection Board or the affected people, and the DPDP intimations do not discharge the CERT In duty.

One more difference worth noting: the DPDP duty runs from becoming aware, while the CERT In duty runs from noticing or being brought to notice. In an incident, record one timestamped awareness moment and treat it as the anchor for both.

The data breach response playbook on this site runs the DPDP side step by step with a live seventy two hour countdown; add the CERT In report to phase one of your own runbook.