CERT-In 6-Hour Incident Reporting& DPDPA Breach Obligations
Most reportable incidents in Indian enterprises begin with someone clicking, scanning or answering. Two clocks start at once — CERT-In’s six hours from awareness, and the DPDPA’s notification duty — and neither waits for you to finish investigating.
Get the Full Guide
Enter your details for instant access to the full guide and continue with the scope check below.
Here it is.
Your download should have started automatically. If it did not, use the button below.
Prefer to talk it through? Write to info@shieldbyteinfosec.com or call +91 8104995634 / 9820989640.
Why Employee Reporting Matters in Cyber Incident Response
Nothing here says people are careless. It says the attack has moved to the one layer no gateway inspects — a well-written sentence, arriving at the moment it is most plausible.
Verizon’s 2026 DBIR. Not 62% negligence — 62% of intrusions passed through a person doing their job.
The third most common breach pattern in the 2026 DBIR. Phishing accounts for 16%; pretexting for a further 6%.
Up roughly 85% on 2023. Phishing, spoofing and identity theft sit on the mandatorily-reportable list.
Across 28.15 lakh cases reported to I4C, against 22.68 lakh the year before.
Which Cyber Incidents Must Be Reported to CERT-In?
The lure is written by a machine
Generative models remove the two tells staff were trained on — broken grammar and generic framing. The message arrives in the reader’s own language, in their manager’s rhythm, referencing work that is genuinely underway.
It no longer arrives only by email
A QR code on a printed notice, an SMS about a delivery, a voice call from the service desk. An incident that arrives by phone starts exactly the same two clocks as one that arrives by inbox.
Shadow AI widened the surface
The 2026 DBIR finds 45% of employees are now regular users of AI on corporate devices, up from 15% the year before — and 67% of them are signed in with non-corporate accounts.
There is no technical control for a good sentence
A message with no attachment, no link and no spoofed domain passes every gateway ever built. The only control left in the path is the person reading it, and whether they say something.
CERT-In vs DPDPA: Two Breach Notification Timelines
They start together, they run on different rules, and both are measured from the moment somebody in your organisation reasonably believes something has happened.
Clock one · CERT-In
| When | What is required |
|---|---|
| T + 0 | The clock starts at awareness, not confirmation. The moment a security team member reasonably believes an incident has occurred you are on it — a still-unproven phishing report already counts. |
| T + 6 hrs | Report to CERT-In. Six hours from awareness, in the prescribed format. There is no extension for an incomplete investigation. |
| Ongoing | 180-day ICT log retention, held within India. Produced on request — including the mail-gateway and authentication logs that show what the user actually did. |
| Annually | Empanelled audit. Since the Sep 2025 MSME baseline, smaller vendors in your chain commission one too. |
| If you miss it | Section 70B consequences. Penalties, loss of empanelment, exclusion from tenders. |
Clock two · DPDPA
| When | What is required |
|---|---|
| On breach | Notify affected data principals in plain language. What happened, the impact on them, and the remedy. Legal phrasing that obscures the harm does not satisfy this. |
| On breach | Notify the Data Protection Board. Personal-data breaches are notifiable irrespective of whether you judge the harm to be material. Detailed information should be provided to the Board within 72 hours, or such further time as permitted. |
| Within 90 days | Act on data-principal requests. Access, correction, erasure — including any that arrive because of the breach. |
| If you are an SDF | Additional duties. India-based DPO, independent audits and DPIAs above the Significant Data Fiduciary thresholds. |
| Exposure | Up to ₹250 crore per instance. Once the Board’s full powers apply from May 2027. The Rules were notified 14 Nov 2025 and phase in until then. |
Six Incident Response Controls to Establish Before a Breach
None of these can be built while the clock is running.
A reporting path your staff actually use
Six hours from awareness only helps if the person who clicked tells you in minutes rather than hiding it.
Report-rate data, not just click-rate
Click rate measures exposure; report rate measures whether the clock can start in time.
Coverage of every channel
Email phishing, quishing via QR, smishing over SMS and vishing by voice call.
Named owners and a rehearsed decision
Who declares awareness, who files, who drafts the plain-language notice — agreed before the day it is needed.
Logs you can produce
180 days, held in India, mapped to the users involved.
The same expectations of your vendors, in writing
Their breach starts your clock, and their notification timeline has to leave you time to meet it.
How Phishing Simulations Strengthen Incident Readiness
Not a trap, and not a test of loyalty. A controlled rehearsal of the moment the organisation is most exposed, run often enough that the response becomes ordinary.
Baseline honestly
Segment the workforce and run one campaign before any training, so the number you improve against is real rather than flattering.
Simulate the way attacks actually arrive
By department, role, language and difficulty — and across every channel the attacker has, not just the inbox.
Train at the moment of the mistake
The teachable second is the one immediately after the click. Auto-enrolment at that moment outperforms an annual module by a distance.
Reinforce between campaigns
Awareness decays. Posters, wallpapers, leaderboards and praise for the people who reported keep it in daily sight.
Produce evidence, not opinion
Completion records, acknowledgements and certificates an auditor will accept without a follow-up conversation.
CERT-In Incident Reporting and DPDPA Breach Readiness
Click rate — measures exposure
How many people were fooled. Useful once, as a baseline. It falls quickly and then flattens, which makes it a comfortable number to report and a poor one to manage.
Report rate — measures whether the clock can start
How many people told you, and how fast. This is the only behavioural number the six-hour rule actually depends on, and the one that decides whether you file in time or explain later.
How ShieldPhish Supports Incident Response Readiness
Simulation, training, intelligence and evidence in one console — so a click in a simulation triggers the right training, and every action lands in the audit trail.
Phishing Simulation
AI template engine, quishing, spoofing and Emotional Vulnerability Score.
Awareness Training
Courses, quizzes, gamification, certification and a live dashboard.
Threat Intel
Dark-web monitoring, credential leak detection and early alerts.
Document Hub
Policy repository, access control, acknowledgement and versioning.
Vision Board
Awareness posters and wallpapers that keep the message visible.
Data Privacy
DPDPA-aligned data-principal request handling, in the same console.
Check Your CERT-In and DPDPA Incident Readiness
Twenty statements about how your organisation actually behaves on the day. Answer them with the people who run the mail gateway and the awareness programme in the room — where you cannot answer in one sentence, the honest answer is no.
Open the check
Fill the short form at the top of this page. It opens the check here and the full document at the same time — it takes about a minute.
Take me to the formWhat is actually arriving
How people report
What you run today
Training and culture
Evidence and the clock
Strengthen Your CERT-In and DPDPA Incident Readiness
CERT-In empanelled assessors work through this with the people who own the systems, and leave you with evidence rather than an opinion.
Verizon 2026 Data Breach Investigations Report; CERT-In figures via PIB (2025); Ministry of Home Affairs / I4C (2025); CERT-In Directions under s.70B of the IT Act, 2000; Digital Personal Data Protection Rules, 2025. Platform capabilities as published in ShieldPhish collateral. This page is a summary prepared for orientation; it does not replace the underlying instrument or professional advice.