Incident reporting guide
CERT-In's Directions of 28 April 2022 give most organisations in India six hours to report a listed cyber incident. From May 2027, Rule 7 of the DPDP Rules adds two notices for a personal data breach: one to each affected person and one to the Data Protection Board. Here is what each requires, checked against the official texts.
The two regimes
They differ in who reports, what triggers a report, who receives it and when. A breach of personal data can trigger both.
| CERT-In Directions | DPDP Act and Rule 7 | |
|---|---|---|
| Source | Directions No. 20(3)/2022-CERT-In of 28 April 2022, under section 70B(6) of the IT Act, 2000. | Section 8(6) of the DPDP Act, 2023 and Rule 7 of the DPDP Rules, 2025. |
| Who reports | Service providers, intermediaries, data centres, body corporate and government organisations. | The Data Fiduciary: the organisation deciding how the personal data is used. |
| What triggers it | Any cyber incident of a type listed in Annexure I. | A personal data breach, as defined in section 2(u). |
| Deadline | Within 6 hours of noticing the incident or being told about it. | Without delay; a detailed report to the Board within 72 hours of becoming aware. |
| Who is told | CERT-In. | Each affected person, and the Data Protection Board. |
| In force | Since late June 2022, sixty days after issue; since 25 September 2022 for MSMEs. | From May 2027. |
| If you do not | May attract the penal provisions of section 70B(7) of the IT Act. | A penalty of up to 200 crore rupees for failing to give notice. |
Section 2(u) defines it as "any unauthorised processing of personal data or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises the confidentiality, integrity or availability of personal data". There is no size or harm threshold. A lost laptop or a ransomware outage that locks you out of customer records counts, as well as a leak.
The Directions took effect sixty days after they were issued on 28 April 2022. CERT-In's notification of 27 June 2022 moved the start to 25 September 2022 for MSMEs, and gave data centres, VPS, cloud and VPN providers the same extra time for validating subscriber names, addresses and contact numbers. CERT-In's own directions page lists no later amendment.
Annexure I
Annexure I of the Directions lists twenty types. Two are worth noticing first: data breaches and data leaks (items xi and xii), and attacks on AI and machine learning systems (item xx).
| Item | Incident type |
|---|---|
| i | Targeted scanning or probing of critical networks or systems |
| ii | Compromise of critical systems or information |
| iii | Unauthorised access of IT systems or data |
| iv | Defacement of a website, or intrusion into one and unauthorised changes such as inserting malicious code or links |
| v | Malicious code attacks: viruses, worms, Trojans, bots, spyware, ransomware, cryptominers |
| vi | Attacks on servers such as database, mail and DNS, and on network devices such as routers |
| vii | Identity theft, spoofing and phishing attacks |
| viii | Denial of service (DoS) and distributed denial of service (DDoS) attacks |
| ix | Attacks on critical infrastructure, SCADA and operational technology systems, and wireless networks |
| x | Attacks on applications such as e-governance and e-commerce |
| xi | Data breach |
| xii | Data leak |
| xiii | Attacks on Internet of Things (IoT) devices and their systems, networks, software and servers |
| xiv | Attacks or incidents affecting digital payment systems |
| xv | Attacks through malicious mobile apps |
| xvi | Fake mobile apps |
| xvii | Unauthorised access to social media accounts |
| xviii | Attacks or suspicious activity affecting cloud computing systems, servers, software or applications |
| xix | Attacks or suspicious activity affecting systems related to big data, blockchain, virtual assets and exchanges, custodian wallets, robotics, 3D and 4D printing, additive manufacturing and drones |
| xx | Attacks or suspicious activity affecting systems related to artificial intelligence and machine learning |
CERT-In's FAQ 30 says an Annexure I incident should be reported within six hours when it meets these criteria: severe incidents (such as denial of service, intrusion or ransomware) on any part of the public information infrastructure; data breaches or data leaks; large-scale or most frequent incidents such as intrusion into computer resources or websites; and incidents affecting the safety of human beings. The FAQ says of itself that it is not a legal document and does not amend the Directions, so treat the full Annexure as the rule and FAQ 30 as CERT-In's reading of it.
Beyond the report
The six-hour report is one of six directions. The other five set what must already be in place: clocks, a contact, logs, a way to answer orders, and records for hosting and virtual asset firms.
Paragraph (i): connect all ICT systems to the NTP servers of NIC or NPL, or to servers traceable to them. FAQ 43 lists samay1.nic.in, samay2.nic.in and time.nplindia.org. Systems spanning several countries may use another accurate source that does not deviate from them.
Paragraph (iii): designate one person to deal with CERT-In and send their details in the Annexure II format to info@cert-in.org.in. FAQ 29 extends this to providers serving users in India without a physical presence here.
Paragraph (iv): enable logs on all ICT systems and keep them securely for a rolling 180 days, to hand over with a report or on CERT-In's order. FAQ 37 names firewall, IPS, SIEM, server, VPN and application logs, with failed as well as successful events.
Paragraph (iii): when CERT-In orders it, take the action or provide the information it asks for, in its format and timeframe, up to near real time. Missing the timeframe counts as non-compliance.
Paragraph (v): data centres, VPS, cloud and VPN providers keep validated customer names, addresses and contact numbers, hire periods, IP addresses, purpose and ownership, for five years after the account ends. FAQ 34 excludes enterprise VPNs.
Paragraph (vi): virtual asset service providers, exchanges and custodian wallet providers keep KYC records and transaction records for five years, detailed enough to reconstruct each transaction.
From May 2027
A personal data breach that is also an Annexure I incident starts three duties at once. In order:
CERT-In's six hours start on noticing it or being told about it (FAQ 24). DPDP's duties start on becoming aware of a personal data breach (Rule 7).
By email, phone or fax, with what you know so far, using CERT-In's incident reporting form. Send the rest later within a reasonable time (FAQ 30).
Through her user account or registered contact: what happened and when, the likely consequences for her, what you are doing about it, what she can do, and who to contact (Rule 7(1)).
A description of the breach: its nature, extent, timing and location, and the likely impact (Rule 7(2)(a)).
Updated details, the facts and reasons behind the breach, mitigation, findings on who caused it, measures against recurrence, and a report on the notices sent to individuals. The Board can allow longer on a written request (Rule 7(2)(b)).
CERT-In expects 180 days of logs. From May 2027, Rule 6(1)(e) asks Data Fiduciaries to keep logs and personal data for one year to detect, investigate and recover from unauthorised access.
Before an incident
We write these into an incident response plan and rehearse it with your leaders. See incident response, and for the wider DPDP timeline, DPDP Act compliance.
This guide explains the published texts. It is not legal advice. Sources: CERT-In's Directions of 28 April 2022, its FAQs of May 2022 and its extension of 27 June 2022; the DPDP Act, 2023 and the DPDP Rules, 2025 (G.S.R. 846(E)).
Related: DPDP Consent Managers guide, threat detection, Blue Team exercises.
FAQ
If you are a service provider, intermediary, data centre, body corporate or government organisation, yes. CERT-In's FAQ 25 reads body corporate as any company, including a firm, sole proprietorship or other association of individuals in commercial or professional activities. FAQ 26 applies the Directions to any entity in the matter of cyber incidents, including foreign firms serving users in India. Individual citizens are not covered (FAQ 7).
Report what you have. CERT-In's FAQ 30 says entities may provide information to the extent available at the time of reporting, and report additional information later within a reasonable time. The clock runs from noticing the incident or being told about it (paragraph (ii) of the Directions, and FAQ 24).
Whoever notices it. FAQ 13 says any entity which notices the cyber security incident shall report it, and that the obligation is neither transferable nor removed by contract. FAQ 31 confirms the Directions apply when your data is affected in a third party's systems. Agree with each vendor how fast it will tell you, because your own six hours start when you are told.
No. FAQ 22 says the reporting duty under section 70B of the IT Act and the CERT-In Rules, 2013 is statutory and overrides any confidentiality clause in a contract, by virtue of section 81 of the IT Act.
Paragraph (iv) of the Directions says logs are kept within the Indian jurisdiction. CERT-In's FAQ 35 adds that logs may also be stored outside India as long as they can be produced to CERT-In in a reasonable time, while FAQ 36 says a service provider offering services to users in India needs to maintain logs in the Indian jurisdiction. If you serve users in India, keep a copy here.
No. From May 2027, Rule 7 of the DPDP Rules requires a notice to each affected person and to the Data Protection Board, with set contents, and a detailed report to the Board within 72 hours. A report to CERT-In goes to a different body with different contents. A breach that is both an Annexure I incident and a personal data breach needs all three.
For the CERT-In Directions, non-compliance may attract the penal provisions of section 70B(7) of the IT Act; CERT-In's FAQ 23 says the power will be used reasonably and when non-compliance is deliberate. Under the DPDP Act, from May 2027, failing to notify the Board or an affected person of a breach can bring a penalty of up to 200 crore rupees, and failing to take reasonable security safeguards up to 250 crore rupees (Schedule items 2 and 1).
Let's talk
We write your incident response plan and playbooks around CERT-In's clock and the DPDP notices, then rehearse them with your leaders in a tabletop exercise. We reply within one working day.