DPDP vs CERT-In: Which Applies When You Are Breached?
These are two separate regimes that can fire on the same incident. The most common failure is a plan that satisfies one of them and quietly misses the other.
They are different instruments
The DPDP obligation comes from Rule 7 of the DPDP Rules 2025 and is about personal data. The CERT-In obligation comes from directions issued under the Information Technology Act and is about cyber incidents, whether or not personal data is involved.
Neither displaces the other. An incident affecting personal data on a compromised system can sit inside both.
Different recipients, different content
- DPDP reports go to the Data Protection Board, and separately to each affected Data Principal, and Rule 7(1) prescribes five specific items the individual must be told.
- CERT-In reports go to CERT-In, in the format its directions specify, for the categories of incident it lists.
- The two describe the same event for different purposes: harm to individuals versus national cyber situational awareness.
Different clocks, both starting early
Rule 7 runs from becoming aware. Intimation to affected individuals is due without delay, an initial description to the Board without delay, and detailed information within seventy-two hours. The CERT-In directions run on their own, tighter schedule for covered incidents.
Because both start on awareness rather than on confirmation, an organisation that waits to scope the incident before reporting anything is running down both clocks at once.
Design one declaration event that triggers both assessments. Two separate triggers owned by two separate teams is how an obligation goes unreported.
Infosek Team
What a combined procedure needs
- A single point at which the organisation declares awareness, and a named person authorised to declare it.
- An immediate parallel assessment: is this a reportable cyber incident under the CERT-In directions, a personal data breach under DPDP, or both?
- Separate prepared templates for each recipient, since the content requirements differ.
- One incident log that satisfies both, and Rule 6(1)(e) logging behind it so the facts are reconstructable.
- A named responder with business contact information ready to publish to Data Principals, as Rule 7(1)(e) requires.
If you are a regulated entity, there may be a third
RBI-regulated entities, SEBI-regulated intermediaries and others carry sector reporting duties of their own. Map every reporting obligation that applies to your entity once, in advance, rather than discovering the third one mid-incident.
Common questions
Does DPDP replace the CERT-In breach reporting requirement?
No. They are separate obligations under separate instruments. DPDP breach intimation under Rule 7 goes to the Data Protection Board and to affected Data Principals. CERT-In directions apply to specified cyber incidents and are reported to CERT-In. An incident can trigger both.
What is the difference between the DPDP and CERT-In breach timelines?
Rule 7 of the DPDP Rules requires intimation to affected Data Principals without delay, intimation to the Board without delay, and detailed information to the Board within seventy-two hours of becoming aware. The CERT-In directions operate on their own, much shorter timeline for the categories of incident they cover.
Need one procedure that satisfies both?
Infosek handles the whole of DPDP: data mapping, consent and notices, security controls, vendor contracts, breach readiness and the audit itself. We do the work, not just the gap report.
Book Free 30-Min Assessment
