CERT-In Incident Reporting: What Businesses Should Know
Reviewed by CA Nikhil Gupta · Last reviewed 5 June 2026
A CERT-In reporting guide covering covered entities, six-hour timing, reportable incidents, logs, time synchronisation and continuing information.
For broader context, see the Data Privacy, DPDP and Cyber Law — Full Compliance Hub.
CERT-In’s clock runs from noticing the incident or being informed of it—not from completing the forensic investigation.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
CERT-In’s 28 April 2022 Directions apply to service providers, intermediaries, data centres, body corporates and Government organisations within scope.
Specified incidents must be reported within six hours of notice.
Covered entities must designate a point of contact and provide information or assistance when directed.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
- CERT-In’s 28 April 2022 Directions apply to service providers, intermediaries, data centres, body corporates and Government organisations within scope.
- Specified incidents must be reported within six hours of notice.
- Covered entities must designate a point of contact and provide information or assistance when directed.
- ICT-system logs must be securely maintained for 180 days within Indian jurisdiction under the Directions.
For the connected rule, example or next step, see Segment Reporting: How Profitable Divisions Hide Loss-Making Businesses.
The five-point review
| Check | What to examine |
|---|---|
| Entity | Whether the organisation is covered. |
| Incident | Listed or otherwise reportable event. |
| Clock | First detection or notice. |
| Report | Known facts, indicators and contact. |
| Evidence | Logs, time sync and updates. |
Practical example
A company detects malicious logins at 9 a.m. and confirms takeover at 3 p.m. The team should not assume the six-hour analysis begins only at confirmation; it must document when the reportable incident was first noticed.
How to apply the framework
Prepare a pre-filled reporting form with entity, network and contact details.
Synchronise system clocks and preserve logs because conflicting time zones can misstate the reporting window.
Operating workflow
Define the processing or incident precisely
Identify the people, data, system, purpose, owner, vendor and transaction or event. Review entity, incident and clock together. Do not start from a policy template or software feature; start from what the business and system actually do.
Separate current duties from future-state DPDP readiness
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative IT, CERT-In, telecom, banking, insurance, employment, consumer, contract and criminal-law requirements. Build the future DPDP process now, but do not describe a scheduled rule as already legally operative.
Preserve proof and improve the system
Keep the approved decision, notice or workflow version, access or event logs, vendor evidence, user communications and remediation record. Update product design, role access, retention, support scripts or incident playbooks so the same weakness does not recur.
Action checklist
- Appoint point of contact.
- Maintain incident matrix.
- Start clock at first notice.
- File initial report.
- Preserve 180-day logs.
- Send updates.
Evidence to keep
- Contact designation
- Classification record
- Timestamps
- Report acknowledgement
- Logs
Warning signs
- Wait for board meeting
- Clock undocumented
- Logs held only overseas
- Time zones conflict
- No update after initial report
Finin2min takeaway
Privacy governance is an operating system, not a policy PDF. The data map, purpose, access, vendor, retention, user workflow, incident response and evidence file must all tell the same story.
Frequently Asked Questions
Source and review trail
Use the current official instrument, portal or regulator publication before acting. This panel separates the category authority from page-specific references.
- Primary category
- Data Protection, Cyber & IT Law
- Official starting point
- www.meity.gov.in