TheDPDPAct.com -
Official WhatsApp Channel
Stay updated with the latest DPDP Act news, compliance insights, updates, and resources.
Join Our WhatsApp Channel →Regulators in India expect a first report of a serious cyber incident within six hours. According to IBM's 2026 report, the average organization takes 247 days to identify and contain a breach. Those two numbers describe the same event from opposite ends, and the distance between them is where reporting failures happen. If your security operations centre raised an alert at 2 a.m. tonight, would your team know who must be told, by when, and with what details? Most organizations in Delhi NCR, from government-linked entities to the fintech and services firms of Gurugram and Noida, have never had to answer that under pressure. This guide lays out the clocks as they stand today, including one that has not started ticking yet.
Clock One: CERT-In's Six Hours (Live Today)
India's national incident-response agency, CERT-In, issued directions in 2022 that require specified cybersecurity incidents, such as unauthorized access, malware infection, or critical system compromise, to be reported within six hours of becoming aware of them. The directions apply to entities operating in India and can reach foreign entities offering services here.
If the incident touches a Protected System or critical information infrastructure, the six-hour report goes to both CERT-In and NCIIPC, the designated authority for critical infrastructure. Sector regulators such as the RBI, SEBI, IRDAI, and the Central Electricity Authority add their own reporting obligations for finance, securities, insurance, and power. Timelines differ by regulator, so check your sector's current circulars instead of assuming six hours covers everything.
An initial notification should cover the nature of the incident, when it was detected, the affected systems or data, and the immediate mitigation steps taken.
Clock Two: The DPDP Board Report (Coming May 2027)
Under Rule 7 of the DPDP Rules, 2025, a data fiduciary that becomes aware of a personal data breach must follow a two-stage process with the Data Protection Board:
* Immediately, without delay: a description of the breach, including its nature, extent, timing, and location, plus its likely impact.
* Within 72 hours: an updated and detailed report covering the facts and reasons behind the breach, mitigation measures, any findings about who caused it, remedial steps to prevent recurrence, and a report on the intimations sent to affected individuals. The Board may allow a longer period, but only on a written request.
Failing to notify can be expensive. The Act's penalty schedule sets a ceiling of up to INR 200 crore for not notifying the Board and affected individuals, and up to INR 250 crore for failing to maintain reasonable security safeguards.
These obligations are part of the main operational provisions scheduled to take effect about 18 months after the November 2025 notification, which points to May 2027. Sources differ by a day on the exact date, so confirm it against the official notification.
Clock Three: Telling the People Affected
Alongside the Board report, Rule 7 requires notifying each affected individual without delay, through their user account or the communication mode they registered with you. The notice must be concise, clear, and plain, and it must describe the breach, the likely consequences, the mitigation measures you have taken, the safety steps the individual can take, and a business contact who can answer questions.
This is the notice that customers and the press will actually read. A vague or late one can do more reputational damage than the breach itself.
Do Not Mistake Delay for Relief
Here is the part most guides skip. As of the most recent reporting I found, in August 2026, the Data Protection Board had no appointed chairperson or members. The government sought nominations in May 2026 and advertised the posts in June, but no appointments had been announced. The Board's own powers and the penalty provisions are also scheduled to start only in May 2027. Legal commentators describe a regulator that exists on paper but cannot yet receive a complaint or issue an order.
It is tempting to read that as a grace period. It is not, for three reasons.
- CERT-In is live now. The six-hour rule has applied since 2022 and does not depend on the Board.
- The Board will arrive on a deadline. When it starts operating, organizations that have never rehearsed a notification will be drafting their first one against a regulator's clock.
- Courts and customers do not wait. Disputes may land in courts in the meantime, and enterprise buyers already ask about breach readiness in security questionnaires.
The First Six Hours: A Working Playbook
Preparation beats improvisation. These steps cost little before an incident and a great deal during one.
1. Name a single decision-maker. Someone must be able to declare an incident and authorize external reports without a committee meeting.
2. Keep one fact log. Build one timeline of what happened and when, and feed every notice (CERT-In, sector regulator, Board, customers) from it. Inconsistent stories across filings create their own problems.
3. Preserve evidence early. Snapshot affected systems and secure logs before containment actions overwrite them.
4. Pre-draft the notices. Keep templates for the CERT-In report, the two-stage Board report, and the plain-language customer notice, so people fill in facts instead of writing from scratch.
5. Map your regulators now. List which agencies apply to you, their clocks, and who files for each.
6. Rehearse. A tabletop exercise that runs a simulated incident from alert to final notice exposes gaps within an hour.
Why This Matters in Delhi NCR?
The region concentrates exactly the organizations most likely to face overlapping obligations: government departments and public-sector undertakings, regulated financial firms, and a large base of technology and services companies in Gurugram and Noida. The Data Protection Board itself is set to be based in New Delhi, which makes the region the natural reference point for how DPDP enforcement will unfold. An organization operating here is more likely to sit under several reporting regimes at once, so a single clear process matters more.
Where ILLUME Intelligence Can Help?
ILLUME Intelligence supports this end to end. Our Incident Response Management service helps contain and investigate incidents, and our DPO Services and DPDP compliance work help you build the notification workflow, templates, and governance the Rules will expect. If you are unsure which clocks apply to you, a readiness review and a tabletop exercise is the fastest way to find out.
The Bottom Line
A single breach can start up to three reporting clocks, but only one of them is running today. Treat the gap before May 2027 as rehearsal time, not breathing room. Know your regulators, assign an owner, pre-draft your notices, and practice until six hours feels manageable. When the Board becomes operational, the organizations with a tested process will file calmly, and the rest will learn the rules during their worst week.
