A personal data breach affecting people in India can trigger two separate reports. CERT-In wants listed incidents, including data breach and data leak, reported within 6 hours of noticing. The DPDP Rules ask for a prompt notice to the Board and affected people, then a detailed report within 72 hours. They are different duties with different readers.
The comparison
| CERT-In directions (2022) | DPDP Rules 2025, rule 7 | |
|---|---|---|
| Trigger | Noticing an incident type from Annexure I | Becoming aware of a personal data breach |
| Who reports | Service providers, intermediaries, data centres, body corporate, government organisations | Data Fiduciary |
| Who receives | CERT-In | The Board, and each affected Data Principal |
| First deadline | 6 hours | Without delay |
| Second step | Additional information later within reasonable time (FAQ) | Detailed report within 72 hours, or longer if the Board allows |
| Scope | Twenty listed incident types, many not involving personal data | Personal data breaches only |
| Status | In effect since 2022 | Rule 7 starts eighteen months after the Rules were published |
Where they overlap
Data breach and data leak are on the CERT-In list, and the FAQ names data breaches and leaks among the cases that must meet the 6 hour window. A leak of personal data therefore hits both.
The inputs overlap as well. Both need: when you noticed, which systems, what data, what you have done to contain it. One incident record can feed both messages.
Where they differ
- CERT-In has no direct message to affected users. The DPDP rule does, and prescribes the content.
- DPDP needs the identity of affected Data Principals. CERT-In needs the incident type and technical details.
- CERT-In is event based and covers attacks that never touch personal data, such as DoS or defacement.
A single process for both
- One intake: a form that captures time noticed, systems, data types, cause and containment.
- A decision step with two questions: is this an Annexure I type, and is personal data affected?
- Two templates: the CERT-In report and the DPDP notices.
- Two owners if needed: security for CERT-In, privacy or legal for the DPDP messages.
- One timeline log that both reports quote.
Other regulators
Sector rules add more. RBI and SEBI texts refer back to CERT-In, and SEBI sets its own 6 and 24 hour reporting. Those are covered in separate posts.
Quick check
If we report to CERT-In, are we done under DPDP?
No. The DPDP rules name the Board and each affected Data Principal as recipients. They are separate duties.
Do we report to both for a DoS attack?
A DoS attack is on the CERT-In list. If no personal data was breached, rule 7 would not be triggered. Check the facts each time.
Sources
- CERT-In Directions of 28 April 2022
- CERT-In FAQs on the Cyber Security Directions, May 2022
- Digital Personal Data Protection Rules, 2025 (MeitY)
Last reviewed: 19 October 2026.
