Three Clocks, One Incident: What DPDP Changes for Indian Companies Already Reporting to CERT-In
By Paras Kharwal, Founder and CEO, Accredify Global
When an Indian company detects a cyber incident today, most incident response plans start one clock: CERT-In’s six-hour reporting window. That clock has been in force since CERT-In’s directions of April 2022, and most security teams know it well.
From 14 May 2027, the same incident can start two more. The Digital Personal Data Protection Rules, 2025, notified on 14 November 2025, bring the main obligations of the DPDP Act into force after an 18-month phase-in. And for IT services firms, global capability centres and BPOs, a third clock is already ticking in client contracts written to European and US privacy laws.
In audits, the gap I see most often is not missing policies. It is incident plans that assume one regulator, one deadline and one audience.
Clock one: CERT-In, six hours
CERT-In’s 2022 directions require covered organizations to report specified cyber...
Copyright of this story solely belongs to www.expresscomputer.in. To see the full text click HERE
