By Paras Kharwal, Founder and CEO, Accredify Global
When an Indian company detects a cyber incident today, most incident response plans start one clock: CERT-In’s six-hour reporting window. That clock has been in force since CERT-In’s directions of April 2022, and most security teams know it well.
From 14 May 2027, the same incident can start two more. The Digital Personal Data Protection Rules, 2025, notified on 14 November 2025, bring the main obligations of the DPDP Act into force after an 18-month phase-in. And for IT services firms, global capability centres and BPOs, a third clock is already ticking in client contracts written to European and US privacy laws.
In audits, the gap I see most often is not missing policies. It is incident plans that assume one regulator, one deadline and one audience.
Clock one: CERT-In, six hours
CERT-In’s 2022 directions require covered organizations to report specified cyber incidents within six hours of noticing them. They also require system logs to be kept for 180 days. This obligation is about the incident itself, whether or not personal data is involved, and it is already being enforced.
Clock two: the Data Protection Board, 72 hours
Under the DPDP Rules, a data fiduciary that suffers a personal data breach must inform each affected person without delay, in plain language, with what happened, the likely consequences and what they can do. It must also inform the Data Protection Board without delay, followed by a detailed report within 72 hours of becoming aware of the breach.
The audience is different from CERT-In’s. CERT-In wants technical detail. The Board wants to know whose data was affected, what was done to limit harm, and what the people affected were told. A notification drafted for one will not satisfy the other.
Clock three: the client contract
Many Indian companies process personal data on behalf of overseas clients. Those clients often have their own regulator deadlines, so their contracts usually require the Indian processor to notify them within a fixed number of hours, sometimes 24 or 48. That deadline can be the shortest of the three, and it is the one most often missing from internal runbooks because it lives in a legal folder, not the security team’s playbook.
During an ISO 27001 assessment of a SaaS service provider handling customer data, I reviewed the incident response procedures and asked how the organization would manage a potential breach involving customer information. The security team could explain its process for detecting, escalating and containing an incident.
However, when I asked where customer-specific notification deadlines were documented and how those deadlines would be met, the team could not demonstrate a clear process beyond internal escalation. The gap was not in detecting the incident, but in connecting the technical response with contractual reporting obligations—a distinction that becomes even more important under India’s DPDP framework.
Where the clocks collide: logs
The quieter change is about evidence. Rule 6 of the DPDP Rules lists reasonable security safeguards, including encryption or masking, access controls, monitoring, and logs that allow unauthorized access to be detected and investigated. It requires those logs, and the personal data needed for investigation, to be kept for at least one year unless another law requires longer.
That is double CERT-In’s 180 days. Many organizations set log retention once, in 2022, to meet CERT-In. If retention stays at six months, a breach discovered in month eight cannot be investigated with the company’s own logs, and the company cannot show the Board what happened.
What a certificate does and doesn’t prove
Indian firms with ISO/IEC 27001 often ask whether certification covers DPDP. It helps, but it isn’t the same thing. An ISO 27001 audit checks that you have an information security management system that works: risk assessment, incident management, logging, supplier controls and the rest. It does not check whether your consent notices meet the DPDP Rules, or whether your breach notice to individuals says what Rule 7 requires.
ISO/IEC 27701, the privacy extension to ISO 27001, comes closer, because it adds controls for personal data processing. Even then, the DPDP Act is the law and the certificate is evidence. The useful question for an auditor to ask is not “are you certified?” but “show me the last time this control ran.”
Five things to do before May 2027
1. Map every clock in one table. CERT-In, the Data Protection Board, each major client contract, and any sector regulator such as RBI for banks and NBFCs. Note who reports, to whom, within how long, and with what content.
2. Rewrite the incident runbook around the shortest clock. Usually that is the client contract, not the regulator. Make sure the first hour produces the facts every notice will need.
3. Check log retention against one year. Confirm that logs from all in-scope systems, including cloud services and vendors, can be retrieved for at least a year.
4. Draft the notices now. Prepare templates for affected individuals, the Board, CERT-In and clients. Writing them during an incident is how deadlines get missed.
5. Test it once. Run a tabletop exercise with a scenario that triggers all three clocks. Most teams find the gaps in the first fifteen minutes.
The bottom line
CERT-In taught Indian companies to move fast on cyber incidents. DPDP adds a second audience, a longer memory for logs, and consequences measured in hundreds of crores: the Act allows penalties of up to ₹250 crore for failing to take reasonable security safeguards. The companies that will handle May 2027 calmly are the ones that use the seven months left to merge three clocks into one plan.
About the author
– Paras Kharwal is the founder and CEO of Accredify Global, a UAF-accredited certification body based in the Dallas–Fort Worth area that audits organizations in 71 countries, including India. He is an Exemplar Global–certified ISO/IEC 27001 Lead Auditor and ISO 9001 Lead Auditor, with more than two decades of experience in enterprise technology, governance and risk.