CERT-In's 6-hour breach reporting rule explained

CERT-In's Directions of 28 April 2022 require organisations in India to report specified cyber incidents to the Indian Computer Emergency Response Team within six hours of noticing them. The Directions were issued under section 70B(6) of the Information Technology Act, 2000. They cover service providers, intermediaries, data centres, body corporate and government organisations. This is not legal advice. TechSum implements the technical readiness and partner counsel advises on legal interpretation.

Who has to report to CERT-In?

The Directions name five groups: service providers, intermediaries, data centres, body corporate and government organisations. "Body corporate" is broad. It takes in companies, firms, sole proprietorships and other associations of individuals engaged in commercial or professional activity, as defined in the IT Act.

That wording is why many small businesses assume the rule is for banks and telecom firms and then find it applies to them too. Whether your business is covered is a legal reading, so confirm with counsel. For planning, assume you are.

Which incidents must be reported?

Annexure I to the Directions lists the incident types. They include:

• Targeted scanning or probing of critical networks and systems.
• Compromise of critical systems or information.
• Unauthorised access to IT systems or data.
• Defacement of a website or intrusion into a website and unauthorised changes.
• Malicious code attacks such as ransomware, viruses and trojans.
• Attacks on servers such as database, mail and DNS servers.
• Identity theft, spoofing and phishing attacks.
• Denial of service and distributed denial of service attacks.
• Data breaches and data leaks.
• Attacks on cloud computing systems and on applications such as e-commerce and e-governance applications.
• Unauthorised access to social media accounts.

Read the current Annexure I yourself, or have counsel do so, because CERT-In can update it. A phishing email that leads to a compromised mailbox is on the list. So is a defaced website.

What does "within six hours" mean in practice?

The clock starts when you notice the incident or when someone brings it to your notice. It does not start when your investigation is complete. The practical reading is that you send an initial report quickly, with what you know, and add detail later. CERT-In accepts reports at incident@cert-in.org.in and by phone, and publishes the format on its website. Check cert-in.org.in for the current contact details and form.

A six-hour clock changes how a team behaves. At two on a Saturday afternoon, someone has to know it is their job to send the report, with the contact details and a template already in hand.

What else do the Directions require?

The reporting rule gets the attention, but the Directions set several other duties that apply continuously:

• Log retention: enable logs for all ICT systems and keep them securely for a rolling 180 days, within Indian jurisdiction. You must hand them over to CERT-In when it asks.
• Time sync: synchronise system clocks to the Network Time Protocol servers of the National Informatics Centre or the National Physical Laboratory, or to servers traceable to them. Logs from different systems are only useful if their timestamps agree.
• Point of contact: designate a person to liaise with CERT-In and share their details with it.
• Information requests: respond to CERT-In's requests for information and assistance in the time it sets.

Logs kept inside Indian jurisdiction is the item that most often catches teams out. If your application logs go to a monitoring service hosted abroad, check where they are stored and whether a copy stays in India.

How is it different from the DPDP breach rule?

Both can apply to the same event, so keep them side by side.

The CERT-In duty comes from the IT Act and covers listed cyber incidents, whether or not personal data is involved. The report goes to CERT-In within six hours.

The DPDP duty comes from section 8(6) of the Digital Personal Data Protection Act, 2023 and rule 7 of the DPDP Rules, 2025. It covers personal data breaches, with no minimum size, and requires you to inform the Data Protection Board and each affected person, followed by a detailed report to the Board. The Rules' commencement schedule puts most of these duties about 18 months after notification in November 2025. Our overview of the first DPDP steps has the timeline.

A ransomware attack that exposes customer records is both. Your plan should produce one set of facts and send it, in the right form, to each recipient.

How do I get ready before an incident?

A realistic readiness list for a small business:

1. Name an incident lead and a backup. Write down their phone numbers.
2. Switch on logging for servers, cloud accounts, the website, email and VPN, and keep it for 180 days.
3. Store logs somewhere you can reach during an incident, and where a copy is in India.
4. Sync clocks across servers and devices.
5. Keep a one-page report template with the fields CERT-In asks for: who you are, what happened, when you noticed, systems affected, what you have done.
6. Write down who decides to take a system offline, and who calls the lawyer.
7. Ask each key vendor, in the contract, to tell you promptly about incidents on their side. Your six hours begin when you learn of it, but you cannot act on what nobody tells you.
8. Run a short drill once a year. Pick a scenario, such as a leaked admin password, and see who does what.

What are the trade-offs?

Keeping 180 days of logs costs storage, and logs themselves can hold personal data, so they fall under your retention and security rules too. Reporting early can mean reporting something that turns out to be minor. Reporting late carries the legal risk. Most teams accept the first cost to avoid the second.

Smaller teams also face a staffing question. Someone has to watch the logs. Alerts on a handful of high-signal events, such as new admin logins, mass downloads and changed DNS records, work better than a dashboard nobody opens.

Where does TechSum fit?

We set up logging and monitoring, write the response runbook, and help your team rehearse it. For legal interpretation, such as whether a specific event is reportable, partner counsel advises. If you want a first look at your exposure, the DPDP Readiness Scan and the free health check are good places to start. Read more under Trust, Security and Compliance, and see how a VAPT fits into security testing.