Six hours, seventy-two hours

Most companies will find out about a breach on an ordinary afternoon: a staff inbox taken over, a laptop left in a cab, a spreadsheet sent to the wrong client. What happens next is already timed.

The first clock runs today

Under the CERT-In Directions of April 2022, a body corporate must report a data breach, a data leak or unauthorised access to its systems to CERT-In within six hours of noticing it. This applies now, not in 2027. It also asks you to keep logs for 180 days, in India.

The second clock starts on 13 May 2027

Rule 7 of the DPDP Rules asks you to tell each affected person without delay, in plain language: what happened, what it could mean for them, what you have done, what they can do, and who to contact. The Data Protection Board must hear from you without delay too, followed within 72 hours by a full report: the facts, the cause, the fixes and the notices you sent.

Why it matters

The Board’s clock for the detailed report starts on reasonable suspicion, not on confirmation. Working out who to tell, and how, is not something to start on the afternoon it happens.

Do this week: write down who calls whom, who writes to CERT-In, and where your logs live. A one-page plan, made in advance, is most of the work.