Breach Reporting Timeline
Enter when you found the breach. See who you must tell, by when, and what each report must contain, under the CERT-In Directions and Rule 7 of the DPDP Rules 2025.
Last reviewed against the DPDP Act 2023 and the DPDP Rules 2025
A deadline is the easy part
The hard part is having the facts ready in hours: which systems were hit, whose data was in them, and how to reach each of those people. Without a data inventory and contact records, the 72-hour report is written from guesses.
Privacy Labs keeps that inventory, logs the incident, tracks each clock and gives you report templates for the Board.
Common questions
Is the 6-hour breach report a DPDP requirement?
No. The 6-hour report comes from the CERT-In Directions of April 2022 under the IT Act, and it has applied since June 2022. The DPDP Rules ask you to tell the Board and each affected person without delay, and to send the Board a detailed report within 72 hours.
When does DPDP Rule 7 on breach reporting apply?
From 13 May 2027, along with most other obligations under the DPDP Rules 2025. Until then, the CERT-In 6-hour report is the one in force.
When does the 72-hour clock start?
When you become aware of the breach, not when it happened. The Board can allow a longer period if you ask in writing.
Do I have to tell every affected user, even for a small breach?
Rule 7(1) has no size threshold. Each affected Data Principal must be told, without delay, what happened, the likely consequences, what you are doing about it, what she can do, and who to contact.
Should I still check with a lawyer?
Yes, for any real incident. This calculator sets out the timelines in the CERT-In Directions and the DPDP Rules, so you know the clock you are on. A lawyer should confirm the details for your case, and regulated businesses should also check their sector rules from RBI, SEBI, IRDAI and others.
Want to know how your website looks to a regulator? Run the free DPDP scanner
See all free DPDP tools