CERT-In Six-Hour Incident Reporting

CERT-In Six-Hour Incident Reporting: current Indian law, practical example, evidence checklist, risks and Finin2min summary.

Current-law position: As at 4 July 2026, institutional and enabling DPDP provisions are in force. Section 6(9) and section 27(1)(d) are scheduled for 13 November 2026; most substantive processing obligations are scheduled for 13 May 2027. Readiness work should distinguish current duties from future commencement.

Finin2min crux

Specified cyber incidents should be reported within six hours of noticing, with available information supplemented later.

Legal anchors

CERT-In directions and FAQs

The legal conclusion must be read with the current rules, notifications, portal instructions and binding judgments applicable to the event date.

How to analyse it

1. Applicability

Identify the person, activity, location, transaction date, threshold and regulator before applying the rule.

2. Statutory condition

Separate mandatory legal conditions from portal fields, industry practice and contractual preference.

3. Evidence

Link each conclusion to contemporaneous documents, approvals, filings and accounting records.

4. Action

Pre-authorise contacts, templates and clock-start rules.

Practical illustration

A data-centre operator notices unauthorised access overnight.

Decision point: Reperform the analysis if a material fact, date, location or legal status changes.

Evidence pack

data inventory and processing register
privacy notice and consent artefacts
processor contracts and security schedules
retention and deletion logs
incident chronology and regulator communications

What can go wrong?

Internal approval chains can consume the entire reporting period.

Additional risks include stale source use, incomplete authority, inconsistent portal data, weak contemporaneous evidence and failure to consider linked tax, accounting, contract or sector rules.

Finin2min action workflow

Stage	Control	Output
Facts	Freeze transaction, party, date and location	Fact sheet
Law	Read Act, Rules and later instruments	Legal map
Evidence	Reconcile filings, books and documents	Evidence index
Decision	Approve, remediate, disclose or escalate	Signed action note