Home / Glossary / Breach Notification Clock (India)
Glossary

Breach Notification Clock (India)

A breach notification clock is the legal deadline to report an incident, counted from the moment the organisation became aware of it. In India a breach starts two: 6 hours to CERT-In under the CERT-In Directions 2022, and 72 hours to the Data Protection Board under the DPDP Rules.

Also known as: CERT-In 6-hour rule, DPDP 72-hour intimation

Why two clocks

Different laws, different recipients. CERT-In receives the notification under its Directions; the Data Protection Board receives the intimation under the DPDP Rules.

When they start

From awareness, recorded as a decision, not from the timestamp of the first alert.

In Raidu

Wheelhouse’s Breach Clocks run the CERT-In 6-hour clock and the DPDP 72-hour Board clock as separate instruments from one recorded awareness decision, and build both filings on the same screen. See also Breach response in India.

Common questions

Questions about Breach Notification Clock (India).

How long do you have to report a breach to CERT-In? +
Six hours, under the CERT-In Directions 2022.
How long for the Data Protection Board? +
72 hours, under the DPDP Rules.
See it in production

Raidu is the accountability layer for your data and your AI. Intercept. Explain. Prove.

See the runtime, the tamper-evident record, and what a regulator-ready trail looks like for your AI stack.